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FOREWORD 
by the Director General 


New information that has come to light since the Post-Accident Review Meet- 
ing on the Chernobyl Accident (held in Vienna from 25 to 29 August 1986) bears 
on general issues of the operational safety of nuclear power plants in the then Union 
of Soviet Socialist Republics as well as on specific issues relating to the design of 
the Chernobyl type light water cooled, graphite moderated RBMK reactors. 


As regards general issues, the new information demonstrates the lack of feed- 
back of operating experience and the inadequacy of communication between 
designers, engineers, manufacturers, constructors, operators and regulators. These 
deficiencies, coupled with a lack of clear lines of responsibility, were critical factors 
in the events leading up to the Chernobyl accident. These shortcomings have been 
tackled at the national level and some improvements have been made. 


Valuable lessons can be learned from incidents and accidents, as was demon- 
strated after the accident at Three Mile Island nuclear power plant in the United 
States of America in 1979, when far reaching follow-up actions were taken to 
minimize the risk of a recurrence and to improve procedures for accident manage- 
ment. The accident at Chernobyl demonstrated that the lessons from the Three Mile 
Island accident had not been acted upon in the USSR: in particular, the importance 
of systematic evaluation of operating experience; the need to strengthen the on-site 
technical and management capability, including improved operator training; and the 
importance of the man-machine interface. 


Specific issues relating to the design of the RBMK reactors were the subject 
of intensive studies in the USSR after 1986, and some modifications have since been 
made to these reactors and to their operating regimes. More recently, discussions 
have been held at the international level on the safety of nuclear power plants with 
ВВМК reactors. International efforts to assist in the safety assessment of the RBMK 
reactors have been intensified in recent months: 


Efforts to enhance the safety of RBMK reactors will continue; however, inter- 
national assistance can only achieve a fraction of what has to be done at the national 
level. In addition, the general issues mentioned earlier require sustained efforts to 
upgrade the national nuclear safety regime before a safety culture can be inculcated 
at all levels and in all the organizations concerned. 


The emergence of the new information prompted the IAEA’s International 
Nuclear Safety Advisory Group (INSAG) to review its former conclusions about the 
causes of the Chernobyl accident of April 1986. The present INSAG-7 report updates 


the Summary Report on the Post-Accident Review Meeting on the Chernobyl Acci- 
dent (IAEA Safety Series No. 75-INSAG- 1), published in September 1986. The con- 
clusions formulated in the report will broaden the basis for international 
consultations to enhance the safety of RBMK reactors. 

With this report, INSAG has made a valuable contribution to the task that lies 
ahead. 


EDITORIAL NOTE 


Although great care has been taken to maintain the accuracy of information contained 
in this publication, neither the IAEA nor its Member States assume any responsibility for 
consequences which may arise from its use. 

The use of particular designations of countries or territories does not imply any judge- 
ment by the publisher, the IAEA, as to the legal status of such countries or territories, of their 
authorities and institutions or of the delimitation of their boundaries. 

The authors are responsible for having obtained the necessary permission for the IAEA 
to reproduce, translate or use material from sources already protected by copyrights. 

Material prepared by authors who are in contractual relation with governments is 
copyrighted by the IAEA, as publisher, only to the extent permitted by the appropriate national 
regulations. 
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1. INTRODUCTION 


IAEA Safety Series №. 75-INSAG-1 (INSAG-1) was prepared by the Interna- 
tional Nuclear Safety Advisory Group (INSAG) at the request of the Director 
General of the IAEA, following the Post-Accident Review Meeting on the Chernobyl 
Accident held in Vienna over the period 25-29 August 1986. At that meeting, lead- 
ing Soviet scientists and engineers presented the first published account of the acci- 
dent at the fourth unit of the Chernobyl nuclear power station in the Ukrainian 
Republic of the Union of Soviet Socialist Republics on 26 April 1986, along with 
a discussion of the accident's causes. They delivered their account to a large number 
of experts from IAEA Member States and from international organizations. IAEA 
Safety Series No. 75-INSAG-1 was based upon this evidence, on additional material 
presented by the Soviet experts during the meeting and on discussions in Working 
Group sessions among the Soviet experts, INSAG members and other experts who 
assisted them. 

Prior to the Vienna meeting, there had been worldwide speculation about the 
causes of the Chernobyl accident. Analytical studies prompted by this speculation 
were undertaken at numerous locations on the basis of incomplete information on the 
design characteristics of RBMK reactors published in the open literature. The Soviet 
experts' explanation to the meeting of the fault sequence leading to the destruction 
of Chernobyl Unit 4 was drawn from an analytical model ‘normalized’ to sparse and 
inaccurate plant data that had been recorded during the tests carried out on the tur- 
bogenerator which led to the accident. 

The account given to the Vienna Conference stated that it was possible to 
explain the nature of the accident and the extent of the resulting structural damage 
in terms of an uncontrolled reactivity driven excursion. It was said that this excursion 
had been made possible by the signs and magnitudes of the void and power coeffi- 
cients of reactivity characteristic of the state of the reactor at the time. These had 
been inadvertently set up by the operators in preparation for the tests and by the 
effect of pump coastdown which reduced coolant flow as the test progressed. The 
Soviet presentation of the detailed account was accompanied by statements of viola- 
tions by operators of procedures and rules. In the absence of evidence it was not 
possible to examine the appropriateness of these procedures and rules, or the protec- 
tion system, in relation to the reactor's design characteristics. The assertion was 
made that the accident arose through a low probability coincidence of a number of 
violations of rules and procedures by the operating staff and those responsible for 
authorizing the test. 

INSAG members and the experts who were assisting them found this explana- 
tion of the cause of the accident plausible and made no attempt to generate alternative 
scenarios, although it was recognized that there were other possible explanations. All 
parties were aware that the analysis of the transient was very complex and sensitive 
to many factors. In INSAG-1 it was stated (p. 2) that ‘И would be surprising indeed 
if the report, issued after a short period of preparation and at a time when many ques- 


tions remain to be settled by analysis, were found to be correct in every detail. 
INSAG therefore had to use its best judgement in forming conclusions and recom- 
mendations for action.” 

Since the 1986 Vienna Conference, a considerable amount of additional ana- 
lytical work has been carried out by expert groups throughout the world on the 
causes of the Chernobyl accident. Many of the results have been published. Other 
information has also come to light, some of it contradictory. Most important among 
the sources of this information are reports by two Soviet committees chaired by 
N.A. Shteynberg and A.A. Abagyan respectively. These two reports, translated into 
English by the IAEA, are reproduced as Annexes I and П to this document since they 
are not generally available. All this has added to the knowledge that was available 
to the authors of INSAG-1 at the time of the report’s preparation. The present publi- 
cation updates that part of the INSAG-1 report that concentrated on the causes of the 
accident. 


2. FEATURES OF THE REACTOR 


There follow brief summaries of certain design! features of the RBMK-1000 
reactor and the associated plant systems of Unit 4 of the Chernobyl nuclear power 
plant at the time of the accident on 26 April 1986. These design features had a 
primary influence on the course of the accident and its consequences. 


2.1. VOID COEFFICIENT OF REACTIVITY 


A reactor cooled by boiling water contains a certain amount of steam in its 
core. The steam bubbles are called voids, and that proportion of the coolant volume 
which consists of voids is called the void fraction. There is a change of reactivity 
if the void fraction is changed; the ratio of the two changes is termed the void coeffi- 
cient of reactivity, which can be either positive or negative depending on the reactor 
design. A change in reactor power can cause the void fraction to change, and can 
also cause other effects that alter the reactivity. These changes in reactivity must be 
offset by control rods. The ratio between the total reactivity change produced in this 
way and the change in power causing it is called the power coefficient of reactivity, 
and this also can be positive or negative. 

The void coefficient of reactivity is the dominant component of the power 
coefficient of reactivity of RBMK type reactors, reflecting a high degree of depen- 
dence of reactivity on the steam content of the core. The void coefficient depends 
significantly on the lattice pitch of the core and the core composition (number of con- 
trol rods inserted into the core, number of installed additional absorbers, fuel enrich- 
ment and fuel burnup). It has been reported on the basis of studies made after the 
accident that the calculated void coefficient of reactivity for the RBMK-1000 
reactor extended from -1.3 х 104 %-! (6k/k) void for a fresh fuel load to 
+(2.0-2.5) x 10 %7! (6k/k) void for the steady state refuelling regime; and that 
the effect on reactivity of a total loss of coolant was -28 for a fresh fuel load and 
+ (4-5)8 for the steady state refuelling regime (where В is the delayed neutron frac- 
tion). In the design documentation for the RBMK reactor the void coefficient of reac- 
tivity was stated to be negative for initial and steady state conditions (see Annex II, 
Section П-3). Thus, although the void coefficient of reactivity varied over a wide 
range from negative to positive values as a function of the composition of the core 
and the operating regime of the reactor, the fast power coefficient remained negative 
under normal operating conditions. At the time of the accident, the void and power 
coefficients of reactivity were both positive. 


! The concept of design of a nuclear power plant is used frequently in this report. The 
meaning here is that established in the IAEA's Nuclear Safety Standards (NUSS) series of pub- 
lications: The process and the result of developing the concept, detailed plans, supporting cal- 
culations and specifications for a nuclear power plant and its parts. 


2.2. DESIGN OF CONTROL AND SAFETY RODS 


The control rods and the safety rods of an RBMK reactor are inserted into the 
reactor core from above, except for 24 shortened rods which are inserted upwards 
and which are used for flattening the power distribution. A graphite rod termed a 
‘displacer’ is attached to each end of the length of absorber of each rod, except for 
twelve rods that are used in automatic control. The lower displacer prevents coolant 
water from entering the space vacated as the rod is withdrawn, thus augmenting the 
reactivity worth of the rod. The graphite displacer of each rod of all RBMK reactors 
was, at the time of the accident, connected to its rod via a ‘telescope’, with a water 
filled space of 1.25 m separating the displacer and the absorbing rod (see Fig. 1). 
The dimensions of rod and displacer were such that when the rod was fully extracted 
the displacer sat centrally within the fuelled region of the core with 1.25 m of water 
at either end. On receipt of a scram signal causing a fully withdrawn rod to fall, the 
displacement of water from the lower part of the channel as the rod moved down- 
wards from its upper limit stop position caused a local insertion of positive reactivity 
in the lower part of the core. The magnitude of this ‘positive scram’ effect depended 
on the spatial distribution of the power density and the operating regime of the 
reactor. 


2.3. SPEED OF INSERTION OF THE EMERGENCY PROTECTION RODS 


The total time required for insertion of the emergency protection rods (i.e. 
scram rods) into the core, when starting from the upper limit stop switches, was 18 s. 
This slow rate of insertion was principally the result of the narrow confinement of 
the rod in its channel, with the result that the cooling water through which the rod 
had to move acted somewhat like the fluid in a dashpot or motion damper. 


2.4. CONTROL OF POWER 


The RBMK-1000 reactor was equipped with two systems to provide power 
control. The first was the physical power density distribution control system 
(PPDDCS), which had detectors located inside the core. The second system was the 
reactor control system, which had detectors located inside the core as well as outside 
the core in the lateral biological shield tank. 

In principle, the two systems were designed to supplement each other. The 
PPDDCS was designed to control the relative and absolute power distributions 
within the range of 10-120% of their nominal values and to control the total reactor 
power in the range of 5-120% of its nominal value. The reactor control system 
contained the local automatic control and local automatic protection systems 
(LAC-LAP). The LAC-LAP systems received signals from the in-core detectors and 
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FIG. 1. Uppermost position of a control rod of the RBMK emergency protection system 
relative to the reactor core (a) before and (b) after the improvements made in response to the 
Chernobyl accident. Dimensions are given in centimetres. 


operated at power levels above 10% of nominal. Control at lower power levels relied 
solely on the ex-core detectors. 

When the reactor was operated at low power with the PPDDCS and the 
LAC-LAP systems switched off, there was no in-core instrumentation available. The 
operator had mainly to rely on the ex-core monitors for decisions that affected the 
total power and its spatial distribution. However, the ex-core detectors could not 
indicate the distribution of the neutron flux within the core. Moreover, they could 
not indicate the average axial distribution of flux, since they were all located at the 
mid-plane of the core. 

Thus, when controlling the reactor at lower power levels, a reactor operator 
had to rely mainly on experience and intuition rather than on the readings of the 
instrumentation of the control system. Under these circumstances an operator could 
be required to perform manipulations at a rate of up to 1000 per hour. 

Yet control of the RBMK-1000 at startup, when the reactor was free of the neu- 
tron absorber or neutron poison xenon-135, was different from and much simpler 
than control of the power density distribution of the non-uniformly poisoned reactor 
at low power. In this latter situation, which existed to a gross degree during the test 
that ended in the destruction of the Chernobyl Unit 4 reactor, large field non- 
uniformities and high disturbances of both axial and radial power density distribu- 
tions can occur. The operators had little or no experience of control under these 
circumstances. 


2.5. INSTRUMENTATION INDICATING THE REACTIVITY MARGIN 


The computer and instrumentation used to determine the reactivity margin for 
the RBMK-1000 reactor were located approximately 50 m from the control console. 
The data acquisition system received information from about 4000 data input points. 
The system was used to calculate periodically the operating reactivity margin 
(ORM), which is the extra reactivity that would arise if all control and safety rods 
were withdrawn, expressed as a multiple of the total reactivity controlled by a stan- 
dard rod. This data system required about 10-15 min to cycle through all measure- 
ments and to calculate the ORM. The system was designed to provide guidance to 
the operator on steady state control of the power density distribution, and was used 
for this purpose in conjunction with the system for monitoring the spatial power 
distribution. 


2.6. SIZE OF THE REACTOR CORE 


Owing to the largeness of the reactor core (height 7 m, diameter 11.8 m) of 
the RBMK-1000 reactor, the chain reaction in one part of the core is only very 
loosely coupled with that in other, distant, regions. This leads to a requirement to 
control the spatial power distribution almost as if there were several independent 
reactors within the core volume. This situation in extreme conditions can be highly 
unstable, because small spatial redistributions of reactivity can cause large spatial 
redistributions of the power. One manifestation of this decoupling of the core is that 
just prior to the accident the chain reactions in the upper and lower halves of the reac- 
tor were proceeding almost independently, a situation that was exacerbated by heavy 
xenon poisoning in the intervening central region. When control and safety rods were 
inserted from fully withdrawn positions under these circumstances, the positive 
scram effect discussed earlier could cause the lower part of the core to become 
supercritical and the neutron distribution to shift quickly downwards irrespective of 
the distribution just prior to rod insertion. Under the conditions of the accident, the 
shift in power distribution resulting from the positive scram could be substantial. 


2.7. CAPABILITY TO ALTER SAFETY SYSTEMS, PLANT TRIPS 
AND ALARMS 


At Chernobyl Unit 4, there was a ready capability for the operators manually 
to disable certain safety systems, bypass automatic scram trips, and reset or suppress 
various alarm signals. This could be done ordinarily by connecting jumper wires to 
accessible terminals. The operating procedures permitted such disabling under some 
circumstances. 


2.8. SUBCOOLING OF THE INLET WATER 


The RBMK reactors are boiling water reactors. The coolant enters the reactor 
core from below as water, subcooled below the boiling temperature, and boiling 
begins at some distance along the flow path through the core. Analysis and experi- 
ment have shown that the amount of subcooling of the entry coolant of a boiling 
water reactor is important for the stability of the reactor. If the subcooling falls 
to near zero, boiling begins almost at the core inlet and, because of the void coeffi- 
cient of reactivity, reactivity effects become very sensitive to the inlet coolant 
temperature. 

Furthermore, since there is not much change in fluid temperature between the 
coolant pumps and the core inlet, the temperature of the water in the pumps and at 
their intakes is near boiling if the subcooling is very small. Pump behaviour under 
these circumstances can become erratic, and pumping action can be reduced substan- 
tially or can even stop completely under some conditions (a process termed cavita- 
tion). This is discussed further in Section 2.9. 


2.9. PRIMARY COOLANT SYSTEM 


The RBMK-1000 reactor includes two independent primary coolant loops, 
each of which cools half of the reactor. Each loop has four primary coolant pumps, 
three of which are used in normal operation; the fourth is on standby as a backup 
to be used if one of the three in use must be shut down. Each pump has a capacity 
of 5500 to 12000 m?/h. The discharge line from each pump also has a flow control 
valve and a check valve to prevent backflow should the pump fail. Each pump has 
shutoff valves to isolate it if necessary. 

The coolant discharged from each of the three pumps in a coolant circuit is sent 
to a common header and then to 22 distributor headers in each half of the reactor. 
From these headers the flow is distributed to the individual pressure tubes containing 
the nuclear fuel. Each channel has a flow control valve used for optimizing the radial 
distribution of cooling across the core. Boiling occurs as the coolant passes through 
the pressure tubes where they transit the reactor core. The steam- water mixture from 
the various fuelled pressure tubes is carried by individual pipes to two parallel 
horizontal drum type separators in each loop. Steam exits from the top of each sepa- 
rator into two steam headers, from which it passes to the turbines. The condensate 
stream from the turbine in each loop forms a feedwater stream which joins the recir- 
culation flow of water from the steam generators, to become the inlet coolant stream 
at the pump intakes. This completes the coolant circuit flow. 

Under normal conditions, the flow rate of each pump is 8000 m?/h. The nor- 
mal core inlet temperature is 270?C and the core outlet temperature is 284?C at a 
pressure of 7 MPa (approximately 70 atm). The temperature of water flowing into 
the suction header of the main circulating pump depends on the rate of steam produc- 


tion of the reactor, since the steam is condensed after passage through the turbine 
and becomes the cooler feedwater component of the coolant entering the pumps and 
the core. When the flow of this feedwater component of the coolant is decreased 
through reduction of the reactor power, the temperature of the coolant at the pump 
intake and the core inlet increases accordingly. During normal startup or shutdown 
operations, the flow rate through the primary circuit is controlled by using the throt- 
tle type control valves to reduce the flow from the normal rate of 8000 m?/h per 
pump to the range 6000-7000 m?/h. Fewer pumps are used during the low power 
phases of startup and shutdown. These measures ensure that the temperature at the 
main circulating pump inlet is low enough to prevent cavitation in the pumps and to 
maintain an appropriate axial distribution of steam production in the fuel channels. 

Just prior to and at the start of the accident at Chernobyl, all eight pumps were 
running. Four were powered by the turbine remaining on line and four received 
power from the external power source. The use of all eight pumps increased the 
coolant flow rate above that under nominal conditions at full power, reducing the 
already low steam content of the core. This low steam fraction reduced the friction 
factor for coolant flow. In addition, owing to the lower reactor power level at that 
time, the core inlet coolant was only slightly subcooled and, depending on the exact 
settings for feedwater flow and recirculation flow and the pressure distribution in the 
system piping, may not have been subcooled at all. 

These conditions led to the onset of boiling at or near the bottom of the core. 
Under the prevailing operating conditions, the void coefficient of reactivity was 
strongly positive, and the core was in a condition of enhanced susceptibility to diver- 
gent positive feedback of void reactivity if an increase in power were to occur. 
Moreover, at the higher flow rate, the margin to pump cavitation was also reduced. 

When the turbine was tripped, the four pumps it was powering began to slow 
down as the turbine speed was reduced and the associated generator voltage fell. This 
reduced rate of core flow caused the void content of the core to rise and caused an 
initial positive feedback of reactivity which was at least in part the cause of the acci- 
dent. There remain questions of whether pumping capability deteriorated further 
during this period, with pumps circulating a mixed steam- water mixture, or whether 
pumps even cavitated and ceased to circulate the coolant. The report by the Commis- 
sion of the USSR State Committee for the Supervision of Safety in Industry and 
Nuclear Power (SCSSINP) (Annex I, Section 1-4.5) refers to studies which con- 
cluded that the pumps did not cavitate. At the very least, the positive void coefficient 
of the RBMK reactor causes the design to be grossly sensitive to pumping distur- 
bances or failure under the circumstances of the accident. 


2.10. CONTAINMENT 


ВВМК reactors have 'localized' containments. That is, separate parts of the 
reactor and coolant circuit are enclosed in individual containment spaces, each of 


which is meant to protect against rupture of the primary circuit boundary only within 
that space. In particular, the reactor core rests within an enclosure whose side walls 
serve also as shielding. The bottom of the enclosure is the heavy plate on which the 
core is stacked, and the top is a 2000 tonne cover plate. The extensions of the fuel 
channels penetrate the lower plate and the cover plate and are welded to each. The 
separate enclosure spaces of the containment are vented through pipes to an array 
of ‘bubbler pools’ below, which serve as pressure suppression pools, a feature some- 
what resembling an aspect of most boiling water reactors in western countries. 

As was the case at other RBMK reactors having such a confinement space 
about the reactor core, that space was capable of withstanding a pressure buildup 
resulting nominally from steam released by two simultaneous channel ruptures. This 
limitation on capacity was due to the sizes of the pressure relief pipes discharging 
to the bubbler pools. Simultaneous failure of a greater number of fuel channels would 
generate a pressure high enough to fail the containment function by lifting the cover 
plate, in the process severing the remainder of the fuel channels. 


3. THE ACCIDENT 


The sequence of events described in INSAG-1 was derived from the informa- 
tion presented by Soviet scientists at the 1986 Post-Accident Review Meeting on the 
Chernobyl Accident and in discussions between the Soviet scientists and the IAEA 
during the following week. Table I of INSAG-1 and the accompanying text presented 
the sequence of events as then understood, based upon a combination of plant data 
and computer modelling. Since the Vienna meeting there has been considerable 
further analysis of the events which has led to new insights into the physical charac- 
teristics of the RBMK reactor (described in Section 2) and also into some details of 
the progression of the accident on 26 April 1986. These insights have led to a need 
to revise some of the details of the scenario presented in INSAG-1, and to alter some 
important conclusions. 

Detailed accounts of the sequence of events as are now believed to have 
occurred are presented in the Soviet reports by the Commission of the SCSSINP, 
chaired by N.A. Shteynberg, and the Working Group of USSR Experts, chaired by 
А.А. Abagyan (Annexes I and П). Furthermore, some of the information towards 
the end of Table I of INSAG-1 relies heavily on the results of computer modelling 
presented in 1986, which has been superseded by more sophisticated analysis. 
Section 3 contains no discussion of the significance of modelling differences. The 
times, events and significance referred to in the following are as quoted in Table I 
of INSAG-1. 


(1) Isolation of the emergency core cooling system (14:00:00, 25 April) 


It was stated in INSAG-1 that blocking of the emergency core cooling system 
(ECCS) was a violation of procedures. However, recent Soviet information confirms 
that blocking of the ECCS was in fact permissible at Chernobyl if authorized by the 
Chief Engineer, and that this authorization was given for the tests leading up to the 
accident and was even an approved step in the test procedure. INSAG believes that 
this point did not affect the initiation and development of the accident. However, it 
must be recognized that the plant was being operated at half power for the period 
of approximately 11 hours leading up to the accident, with the ECCS blocked out. 
This could be viewed as no violation only if the 11 hour period of half power opera- 
tion were part of the planned test, which it clearly was not. Blocking the ECCS over 
this period and permitting operation for a prolonged period with a vital safety system 
unavailable are indicative of an absence of safety culture. 


(2) Minimum allowable operating power of the reactor (23:10:00, 25 April) 
The statement made in INSAG-1 (p. 15) that ‘‘continuous operation below 


700 MW(th) is forbidden by normal safety procedures owing to problems of thermal- 
hydraulic instability" was based on oral statements made by Soviet experts during 
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the week following the Vienna meeting. In fact, sustained operation of the reactor 
at a power level below 700 MW(th) was not proscribed, either in design, in regula- 
tory limitations or in operating instructions. The emphasis placed on this statement 
in INSAG-1 was not warranted. After the fact, it is clear that such a proscription 
should have applied. 


(3) Transfer from local to global power control (00:28:00, 26 April) 


The INSAG-1 report describes the precipitous fall in power to 30 MW(th) as 
being due to an operator error. Recent reports suggest that there was no operator 
error as such; the SCSSINP Commission report (Annex I, Sections I-4.6, I-4.7) 
refers to an unknown cause and inability to control the power, and A.S. Dyatlov, 
former Deputy Chief Engineer for Operations at the Chernobyl plant, in a private 
communication refers to the system. not working properly. 


(4) Turbogenerator trip signal blocked (01:23:04, 26 April) 


Both the time and significance of the blocking of the turbogenerator trip have 
changed in the light of new information. The event occurred at 00:43:27 rather than 
at 01:23:04 as stated in INSAG-1. The time at which the second turbogenerator was 
shut off remains unchanged. 

This trip was blocked in accordance with operational procedures and test 
procedures, and the SCSSINP Commission (Annex I, Section 1-4.7.4) does not sup- 
port the apportionment of any blame to operating personnel. In the light of new infor- 
mation regarding positive scram, the statement made under the significance column 
of Table I in INSAG-1 that ‘‘This trip would have saved the reactor” seems not to 
be valid. 


(5 Required operating reactivity margin violated (01:00:00, 26 April) 


The recent reports confirm that the minimum ORM was indeed violated by 
01:00:00 on 26 April, and in fact claim that this minimum ORM was also violated 
for several hours on 25 April. According to the record, the computer SKALA, which 
was used to calculate the ORM, became unreliable in the period in which the test 
took place. In the view of INSAG, it is likely that the operator did not know the value 
of the ORM during the critical part of the test. Probably he was aware that continued 
operation under conditions of increasing xenon content of the reactor was reducing 
the ORM. The operators had been accustomed to regarding the lower limit on ORM 
as necessary for control of the reactor's spatial power distribution, but were not 
aware that it had safety significance by virtue of the increase in positive void coeffi- 
cient as the ORM was reduced. Nor were they sensitized to the need to retain a suit- 
able number of control or safety rods in a partially inserted position, for fast 
reactivity decrease if necessary. In fact, the safety significance of the reduction of 
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the ORM is much greater than was indicated in the INSAG-1 report. This whole 
issue is discussed in detail in Section 4 of the present report. 


(6) Steam level protection disabled (01:19:00, 26 April) 


The recent information suggests that the steam drum protection was changed 
as early as 00:36 on April 26 and not at 01:19:00 as stated in INSAG-1. However, 
according to Annex I (Section I-4.7.4), **Contrary to what is stated in official docu- 
ments, the [SCSSINP] Commission does not consider that personnel should be held 
to blame for having blocked the steam pressure protection system of the steam 
separators.'* 

This change of view hinges on the fact that two levels of protection are 
provided for with respect to low steam drum level, one at 600 mm and another nor- 
mally at 1100 mm, depending on the power level. The operators did not reset this 
level and were technically in violation of Item 9, Procedures for Reswitching Keys 
and Straps of the Engineered Protection and Blocking Systems (according to the 
SCSSINP Commission (Annex I, Sections I-4.7.4, I-4.7.8)). However, protection at 
the lower steam drum level remained effective throughout the event. 
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4. MORE RECENT ANALYSES OF THE FAULT SCENARIO 
4.1. THE SCENARIO 


The analytical work which followed in late 1986 had the benefit of the Soviet 
data made available in Vienna. Critical data had been provided there on the control 
rod configuration, the power level and the spatial distribution of power just before 
the accident, as well as information on the thermal-hydraulic conditions that 
prevailed. The information that a double humped spatial distribution of power had 
been created appeared at the outset to bias the magnitude of the positive void coeffi- 
cient of reactivity towards the smaller positive values associated with lower fuel 
irradiation at the upper and lower core boundaries. Some analysts found that with 
the diminished void coefficients it was difficult to match the time history of the power 
excursion as it had been published by the Soviet scientists at the Vienna meeting. A 
search therefore began for an additional mechanism that might have come into play. 
It was in this connection that the positive scram effect of safety rod insertion came 
to be publicly postulated, apparently first in some western analyses. 

Detailed analysis indicated that the reactivity injected by the positive scram, 
when added to that provided by voids from increased boiling, was sufficient to 
generate a severe reactivity driven transient, comparable with that described at the 
Vienna meeting. 

The existence of the positive scram effect was first acknowledged by Soviet 
experts at the Conference on Nuclear Power Performance and Safety in Vienna in 
19872. The SCSSINP Commission report states that this phenomenon had been 
known of at the time of the accident and that it had first been identified at the Ignalina 
RBMK plant in the Lithuanian Republic in 1983 (Annex I, Section I-3.8). Although 
the Chief Design Engineer for RBMK reactors promulgated this information to other 
RBMK plants, and stated that design changes would be made to correct the problem, 
he made no such changes, and the procedural measures he recommended for 
inclusion in plant operating instructions were not adopted. Apparently, there was a 
widespread view that the conditions under which the positive scram effect would be 
important would never occur. However, they did appear in almost every detail in 
the course of the actions leading to the accident. 

Most analyses now associate the severity of the accident with the defects in the 
design of control and safety rods in conjunction with the physics design characteris- 
tics, which permitted the inadvertent setting up of large positive void coefficients. 
The scram just before the sharp rise in power that destroyed the reactor may well 
have been the decisive contributory factor. 

On the other hand, the features of the RBMK reactor had also set other pitfalls 
for the operating staff. Any of these could just as well have caused the initiating event 
for this or an almost identical accident. They included: 


? Nuclear Power Performance and Safety (Proc. Conf. Vienna, 1987) 6 vols, IAEA, 
Vienna (1988). See Ref. [2] to Annex I, p. 134. 
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— Pump failure, disturbance of the function of coolant pumping or pump cavita- 
tion, combined with the effect of the positive void coefficient. Any of these 
causes could have led to sudden augmentation of the effect of the positive void 
coefficient. 


— Failure of zirconium alloy fuel channels or of the welds between these and the 
stainless steel piping, most probably near the core inlet at the bottom of the 
reactor. Failure of a fuel channel would have been a cause of a sudden local 
increase in void fraction as the coolant flashed to steam; this would have led 
to a local reactivity increase which could have triggered a propagating reac- 
tivity effect. 


Thus the question arises: Which weakness ultimately caused the accident? 
There is a second question: Does it really matter which shortcoming was the 
actual cause, if any of them could potentially have been the determining factor? 


4.2. OPERATING REACTIVITY MARGIN 


The ORM is expressed in terms of the number of ‘equivalent’ control rods of 
nominal worth remaining within the core. The definition is not precise, and the 
importance of the quantity for the safety of the plant seems to have been poorly 
understood by the operators. It was widely believed that the importance of the ORM 
centred on the need for a number of control elements in the core adequate for 
manoeuvring to keep the power distribution balanced throughout, especially in the 
light of the tendency for xenon instability in such a large and loosely coupled core. 
Yet the magnitude of the ORM was not conveniently available to the operator, nor 
was it incorporated into the reactor’s protection system. In the discussion of the 
scenario, the operators seemed not to be aware of the other reason for the importance 
of the ORM, which was the extreme effect it could have on the void and power 
coefficients. 

One design approach to prevent unacceptably large void coefficients is to 
increase the fuel enrichment and to balance excess reactivity by the introduction of 
absorbers. In the initial core loading of RBMK reactors, these absorbers were 
present, fixed in fuel channels and separate from the control and protection system. 
As the fuel burnt out, the designers allowed these absorbers to be removed and the 
fuel irradiation to increase. This shifted the void coefficients significantly in the posi- 
tive direction and also made them crucially sensitive to the extent of insertion of the 
control and protection rods. Under the circumstances of the accident, the void coeffi- 
cient increased to such an extent that it overwhelmed the other components of the 
power coefficient, and the power coefficient itself became positive. 

There is one other aspect of the safety importance of the ORM that has 
generally received too little emphasis. The staff of the Chernobyl Unit 4 reactor 
apparently believed that as long as the lower limit on ORM (15 equivalent rods) was 
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satisfied, no matter what the actual rod configuration was, the demands of safety 
were met. This is far from true. An array of safety rods can only contribute to safety 
against a power transient if, in the first entry of the rod into the core after a scram 
signal, it already begins to reduce the reactivity by a significant amount. This capa- 
bility can only be ensured if the absorbing tips of the rods are kept in a region where 
a small insertion causes a relatively large reduction in reactivity. Such a region is 
not found near the boundary of the reactor core. No policy for proper rod positioning 
seemed to have applied during the test that led to the destruction of the reactor. 

The SCSSINP Commission (Annex I, Section I-3.8) reports that, after discov- 
ery of the positive scram effect at Ignalina in 1983, the chief engineering organiza- 
tion informed other organizations and all nuclear power plants with RBMK reactors 
that it intended to impose restrictions on the complete withdrawal of control and 
safety rods from the core. Such restrictions were never imposed and apparently the 
matter was forgotten. 
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5. VIEWS ОЕ INSAG 


The previous sections recount and elaborate on information that has been 
received since the 1986 Post-Accident Review Meeting. It is the purpose of Section 5 
to comment on the issues raised, in terms of any revisions necessary to INSAG-1 
and the importance of the new information in the context of the accident. The three 
interrelated aspects considered are the design features, the actions of the operators 
and the overall framework of control in safety matters. It should be noted that the 
new information is as firmly based as it can be at this time. However, changes in 
that information in the future, as well as in the perception of its significance, cannot 
be ruled out. 


5.1. DESIGN 


A number of possibilities have been cited for the final accident initiator, all of 
which are dependent on specific design features. Rather than entering the debate by 
adopting a firm view, which could shed little if any new light, INSAG prefers to con- 
sider those design issues that raise fundamental questions. 

INSAG-1 repeated the view stated in the Soviet presentation, that a major reac- 
tivity induced transient made possible by the positive power coefficient had been the 
primary cause of the accident. A general comment in INSAG-1 was that automatic 
safety systems must act as soon as the safety of the plant is seriously threatened (p. 
77). The prevention of an accident due to a fast acting positive power coefficient 
depended on quick action by the operating staff; this was in unacceptable conflict 
with this fundamental design tenet. 

The feature of the plant design which led to extensive comment, and which was 
not pointed out in the initial Soviet account, was the deficient system for emergency 
shutdown, which laid the basis for the positive scram. The most likely final event 
now seems to have been the insertion of safety rods at a vital moment in the test, 
which worsened to a destructive level the conditions already prevailing because of 
the positive power coefficient. The accident would then have been a result of ques- 
tionable procedures and practices that manifested and compounded the two crucial 
design defects of rod design and positive reactivity feedback. A particular configura- 
tion of control and safety rods was necessary for the positive scram to occur, and 
a double humped power distribution points to the fact that decoupling had occurred 
between the upper and lower halves of the reactor. All of these conditions prevailed 
at the same time. 

Whether this version of the accident corresponds to reality may never be 
known for certain. Yet it does not really matter whether a positive scram was the 
final step that caused the reactor's destruction. It only matters that such a deficiency 
existed and that it could have been the cause of the accident. It is reprehensible that 
such a deficiency had been known of for so long without its having been eliminated. 
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Certainly the account in INSAG-1 would have been different had the features of the 
control and safety rods been revealed at the Post-Accident Review Meeting in 1986. 

Implicit in the design, and well recognized at the time of preparation of 
INSAG-1, was the requirement to maintain a control rod configuration conferring 
at least the minimum ORM. If, as has been stated since, there was no effective facil- 
ity in the control room for informing the operators of this parameter, then again they 
were ill served by the plant's design, and a judgement different from that made in 
INSAG-1 is necessary. In recent deliberations, INSAG has in fact questioned the 
ORM concept, because its definition (see Section 4.2) is inappropriate for complete 
assurance that the control rod configuration secures fully adequate reactor 
protection. 

With today's knowledge, a general impression gained at the time of prepara- 
tion of INSAG-1 might have been given greater prominence. The design introduces 
conflicting requirements on the control/shutdown system. From the operator's stand- 
point, as a routine matter that system provides means for controlling reactor power 
and trimming the power distribution. The system also affects the value of the void 
coefficient, and it is needed to produce shutdown of the plant in emergencies. There 
is no reason why in normal circumstances these requirements cannot all be met. 
However, the operator's actions in raising almost all the rods to extreme positions 
led to conflict with the simultaneous requirements to maintain shutdown capability 
and appropriate values of the power coefficient (though this latter point was not 
appreciated at the time by the operators). The possibility of conflict among these 
objectives is an undesirable design feature which made the plant unduly reliant on 
sound operator action. INSAG-1 contains the general point as its first lesson and 
recommendation that **Nuclear plant designs must be as far as possible invulnerable 
to operator error and to deliberate violation of safety procedure” (p. 31). 

Regarding the specific characteristics of the shutdown system, INSAG at the 
time judged that it was not sufficiently fast acting, and there is no reason to change 
this view, despite the new views about the possible causes of the accident. Another 
general impression formed at the time is now firmer. The procedures by which the 
plant was controlled were insufficiently well founded in analysis of its safety fea- 
tures. This recognition was in fact raised in the second of the Lessons and Recom- 
mendations of INSAG-1: ‘‘Procedures relating to the operation of the plant must be 
carefully prepared with the safety significance of what is intended continuously in 
view” (p. 31). 


5.2. OPERATOR ACTIONS 


5.2.1. Violations of procedures 


In INSAG-1, views presented by the Soviet experts on the actions of operators 
were given prominence, and it is appropriate here to take advantage of more recent 
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information. Specific violations of procedures were identified in 1986 as major 
causes of the accident. In particular: 


— The statement was made that there was a proscription on continuous operation 
of the reactor at power levels below 700 MW(th). This statement was based 
on incorrect information. There should have been such a proscription, but 
there was none at the time. 


— Eight main coolant pumps were operating at full flow, and И appears that 
flow rates in several exceeded prescribed values. INSAG took the view that 
such operation was unsatisfactory. The SCSSINP Commission (Annex I, 
Section I-4.7.7) reports that operation of all eight pumps at once was not for- 
bidden by any document, including the test procedures, though the excessive 
flow rates, where they occurred, violated procedures. This point is related to 
the question of subcooling, discussed in Section 5.2.3. 


— In INSAG-1 it was stated that operation with too low an ORM was a violation 
of requirements. INSAG now repeats that the violation took place, but that it 
was important for different reasons from those previously understood. It led 
to increased void coefficients, and it led to the positioning of control and safety 
rods such that they were not only ineffective but also destructive. 


— ]t was stated in INSAG-1 that, at the time of the test, three components of reac- 
tor protection had been disabled at Chernobyl. The information now available 
suggests the following, contrary to what was expressed in INSAG-1: 


* Disabling of the ECCS was not prohibited in principle under normal proce- 
dures at Chernobyl. INSAG understands that it was a requirement of the test 
schedule, and, in accordance with regulations, special approval for this dis- 
abling had been obtained from the Chief Engineer. In any case, it was not 
necessary to disable the ECCS for such a long period of time. INSAG 
believes that this did not affect the accident, but it did manifest a poor level 
of safety culture. 


* Disabling of the trip on steam drum water level would have been allowable; 
however, it did not occur, INSAG considers that this would not have 
affected the accident, and in any case another line of protection existed. 


e Disabling of the ‘two turbine’ trip was allowed, and indeed was required 
by normal procedures at low power levels, such as the power level for the 
revised test. In any event, the occurrence of this trip might well have caused 
the destruction of the reactor at the time of turbine trip rather than shortly 
afterwards. 


INSAG wishes to comment further that, while all this may be so, disabling of 
reactor protection seems to have been regarded rather lightly both in the operating 
procedures and by the operators: witness the length of time for which the ECCS was 
out of service while the reactor was operated at half power. 
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5.2.2. Departure from test procedures 


It is not disputed that the test was initiated at a power level (200 MW(th)), well 
below that prescribed in the test procedures. Some of the recent comments addressed 
to INSAG boil down to an argument that this was acceptable because nothing in nor- 
mal procedures forbade it. However, the facts are that: 


— the test procedure was altered on an ad hoc basis; 


— the reason for this was the operators’ inability to achieve the prescribed test 
power level; 


— this was the case because of reactor conditions that arose owing to the previous 
operation at half power and the subsequent reduction to very low power levels; 


— as a result, when the test was initiated the disposition of the control rods, the 
power distribution in the core and the thermal-hydraulic conditions were such 
as to render the reactor highly unstable. 


When the reactor power could not be restored to the intended level of 
700 MW(th), the operating staff did not stop and think, but on the spot they modified 
the test conditions to match their view at that moment of the prevailing conditions. 

Well planned procedures are very important when tests are to take place at a 
nuclear plant. These procedures should be strictly followed. Where in the process 
it is found that the initial procedures are defective or they will not work as planned, 
tests should cease while a carefully preplanned process is followed to evaluate any 
changes contemplated. 


5.2.3. Other deficiencies in safety culture 


The foregoing discussion is in many ways an indication of lack of safety cul- 
ture. Criticism of lack of safety culture was a major component of INSAG-1, and 
the present review does not diminish that charge. Two examples already mentioned 
are worthy of emphasis, since they bear on the particular instincts required in reactor 
operation. 

The reactor was operated with boiling of the coolant water in the core and at 
the same time with little or no subcooling at the pump intakes and at the core inlet. 
Such a mode of operation in itself could have led to a destructive accident of the kind 
that did ultimately occur, in view of the characteristics of positive reactivity feedback 
of the RBMK reactor. Failure to récognize the need to avoid such a situation points 
to the flaws in operating a nuclear power plant without a thorough and searching 
safety analysis, and with a staff untutored in the findings of such a safety analysis 
and not steeped in safety culture. 

This last remark is especially pertinent to the second point, which concerns 
operation of the reactor with almost all control and safety rods withdrawn to posi- 
tions where they would be ineffective in achieving a quick reduction in reactivity if 
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shutdown were suddenly needed. Awareness of the necessity of avoiding such a situ- 
ation should be second nature to any responsible operating staff and to any designers 
responsible for the elaboration of operating instructions for the plant. 


5.3. SAFETY FRAMEWORK 


INSAG-1 concentrated on the immediate issues of the Chernobyl accident and 
made little reference to the regulatory and general safety framework within which 
the plant was operated. A number of matters have since come to light and assertions 
have been made that make it right at this time to present broader views. 

The SCSSINP Commission (Annex I, Section I-3) has compared the design of 
Chernobyl Unit 4 with the declared safety requirements at the time of design, stating 
that the design fell well short of the standards set. INSAG notes that a number of 
the issues raised in the report of the SCSSINP Commission mirror its own concerns. 

This point is further discussed in the following sections. 


5.4. IMPLICATIONS OF IGNORING DEFICIENCIES 


Annexes I and П indicate that important problems now recognized in the 
Chernobyl plant design had in fact been recognized before the accident. INSAG 
notes the observations made at the Ignalina plant in 1983, when the possibility of 
positive reactivity insertion on shutdown became evident, and the event at the Lenin- 
grad nuclear power plant in 1975 which, in retrospect, indicated that events excited 
by local reactivity feedback could cause damage to the reactor. These two events 
pointed to the existence of design problems. Although the events had the semblance 
of potential precursors to an accident, apparently no thorough analysis was per- 
formed. It is a matter of great concern that this important information was not ade- 
quately reviewed and, where it was disseminated to designers, operators and 
regulators, its significance was not fully understood and it was essentially ignored. 


5.5. IMPORTANCE OF COMPETENT SAFETY ANALYSIS 


Independent technical review and safety analysis are a cornerstone of a satis- 
factory safety regime, and in this connection INSAG judges that the design and oper- 
ation of Chernobyl Unit 4 as well as of other RBMK reactors should have received 
a great deal more such attention. The design deficiencies would surely have come 
to light in the course of such a review. The improved understanding derived from 
the review, coupled with a regime requiring independent and formal approval for 
changes to safety related aspects of design and operating procedures, would have 
gone a long way towards averting the accident altogether. Even apart from its 
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obvious intrinsic value, competent safety analysis helps to create an environment of 
attention to safety as a primary objective. This point underlies the importance of 
effective transfer to operators of the knowledge gained through safety analysis. 


5.6. DEFICIENCIES IN THE REGULATORY REGIME 
5.6.1. General deficiencies 


The assurance of safety in the face of the inevitable pressures to meet produc- 
tion goals requires a dedicated operating organization and a strong and independent 
regulatory regime, properly resourced, backed at Government level and with all 
necessary enforcement powers. This sort of regime did not exist in the USSR at the 
time of the accident. 

INSAG is informed that the regulatory regime was ineffective in many impor- 
tant areas, such as analysing the safety of the design and operation of plants, in 
requirements for training and for the introduction and promotion of safety culture, 
and in the enforcement of regulations. It did not function as an independent compo- 
nent in ensuring safety. 


5.6.2. Тһе SCSSINP Commission report 


The SCSSINP Commission report (Annex I) contains extensive information 
emphasizing this lack of an effective nuclear regulatory regime over the years prior 
to the accident. 

The basic design of the RBMK reactors was approved despite the lack of con- 
formity to many of the USSR's design requirements for nuclear power plants. 


5.7. GENERAL REMARKS ON THE LACK OF SAFETY CULTURE 


In its report on the Chernobyl accident, INSAG coined the term 'safety culture' 
to refer to the safety regime that should prevail at a nuclear plant. In its later report, 
INSAG-4, Safety Culture?, which expounded the concept, INSAG traced the 
development of a safety culture to its origin in the national regime of law relating 
to nuclear safety. This establishes the proper chain of responsibility and authority for 
the required level of safety. In both operating and regulatory regimes, safety culture 
must be instilled in organizations through proper attitudes and practices of manage- 
ment. It has been pointed out several times in the preceding discussion that safety 
culture was lacking in the operating regime at Chernobyl. In conformity with its 


3 INTERNATIONAL NUCLEAR SAFETY ADVISORY GROUP, Safety Culture, 
Safety Series No. 75-INSAG-4, IAEA, Vienna (1991). 
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views as expressed in INSAG-4, INSAG now confirms the view that safety culture 
had not been properly instilled in nuclear power plants in the USSR prior to the 
Chernobyl accident. Many of its requirements seem to have existed in regulations, 
but these were not enforced. Many other necessary features did not exist at all. Local 
practices at nuclear plants, of which it may be assumed that practices at Chernobyl 
were typical, did not reflect a safety culture. 


5.8. SUMMARY ASSESSMENT 


In reviewing information made available since the Post-Accident Review 
Meeting, INSAG judges that factors leading to the accident are to be found in the 
safety features of the design, the actions of the operators, and the general safety and 
regulatory framework. There is a need to shift the balance of perception so as to 
emphasize more the deficiencies in the safety features of the design which were 
touched on in INSAG-1, and to recognize the problems conferred by the framework 
within which plant operation was carried out. However, INSAG remains of the view 
that in many respects the actions of the operators were unsatisfactory. 
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(2) 


(3) 


(4) 


(5) 


6. CONCLUSIONS ON FACTORS CONTRIBUTORY 
TO THE ACCIDENT 


Information coming to light since 1986 on the accident at Chernobyl Unit 4 
has been reviewed. It has been approached with caution in recognition that 
further information yet to come might change the picture again. However, it 
appears now that the main outlines of the problems are becoming clear. 


In 1986, INSAG issued its report INSAG-1, which discussed the Chernobyl 
accident and its causes on the basis of information presented to the Post- 
Accident Review Meeting in Vienna in August 1986 by Soviet authorities. The 
new information now come to light has affected the views presented in 
INSAG-1 in such a way as to shift the emphasis to the contributions of parti- 
cular design features, including the design of the control rods and safety 
systems, and arrangements for presenting important safety information to the 
operators. The accident is now seen to have been the result of the concurrence 
of the following major factors: specific physical characteristics of the reactor; 
specific design features of the reactor control elements; and the fact that the 
reactor was brought to a state not specified by procedures or investigated by 
an independent safety body.. Most importantly, the physical characteristics of 
the reactor made possible its unstable behaviour. 


Two earlier accidents at RBMK reactors, one at Leningrad (Unit 1 in 1975) 
and a fuel failure at Chernobyl (Unit 1 in 1982), had already indicated major 
weaknesses in the characteristics and operation of RBMK units. The accident 
at Leningrad Unit 1 is even considered by some to have been a precursor to 
the Chernobyl accident. However, lessons learned from these accidents 
prompted at most only very limited design modifications or improvements in 
operating practices. Because of lack of communication and lack of exchange 
of information. between the different operating organizations, the operating 
staff at Chernobyl were not aware of the nature and causes of the accident at 
Leningrad Unit 1. | 


It is not known for certain what started the power excursion that destroyed the 
Chernobyl reactor. Some positive reactivity is likely to have been generated 
from the growth in voids as the coolant flow rate fell. Addition of further posi- 
tive reactivity by insertion of the control and safety rods that had been fully 
withdrawn during the test was probably a decisive contributory factor. This 
latter effect was a result of faulty design of the rods, the nature of which had 
been discovered at the Ignalina nuclear power plant in 1983. However, no 
correction was made following this discovery at Ignalina, no compensatory 
measures were taken and any dissemination of information to operating organi- 
zations was not followed up. 


The accident can be said to have flowed from deficient safety culture, not only 
at the Chernobyl plant, but throughout the Soviet design, operating and regula- 
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tory organizations for nuclear power that existed at the time. Safety culture, 
fully discussed in INSAG-4 (see footnote 3), requires total dedication, which 
at nuclear power plants is primarily generated by the attitudes of managers of 
organizations involved in their development and operation. An assessment of 
the Chernobyl accident in this respect demonstrates that a deficit in safety cul- 
ture was inherent not only to the stage of operation, but also and to no lesser 
extent to activities at other stages in the lifetime of nuclear power plants 
(including design, engineering, construction, manufacture and regulation). 


The weight given in INSAG-1 in 1986 to the Soviet view presented at the 
Vienna meeting, which laid blame almost entirely on actions of the operating 
staff, is thereby lessened. Certain actions by operators that were identified in 
INSAG-1 as violations of rules were in fact not violations. Yet INSAG remains 
of the opinion that critical actions of the operators were most ill judged. As 
pointed out in INSAG-1, the human factor has still to be considered as a major 
element in causing the accident. The poor quality of operating procedures and 
instructions, and their conflicting character, put a heavy burden on the operat- 
ing crew, including the Chief Engineer. It has also to be noted that the type 
and amount of instrumentation as well as the control room layout made it 
difficult to detect unsafe reactor conditions. However, operating rules were 
violated, and control and safety rods were placed in a configuration that would 
have compromised the emergency protection of the reactor even had the rod 
design not been faulty on the ground of the positive scram effect mentioned 
earlier. Most reprehensibly, unapproved changes in the test procedure were 
deliberately made on the spot, although the plant was known to be in a condi- 
tion very different from that intended for the test. 


INSAG, with the present report, does not retract INSAG-1, nor does it alter 
the conclusions of that report except as clearly indicated here. While the 
balance of INSAG’s judgement of the factors contributing to the accident has 
shifted, the many other conclusions of INSAG-1 are unaffected. 


To summarize, the new information has highlighted a number of broader 
problems contributing to the accident. These include: 
— A plant which fell well short of the safety standards in effect when it was 
designed, and even incorporated unsafe features; 
— Inadequate safety analysis; 
— Insufficient attention to independent safety review; 
— Operating procedures not founded satisfactorily in safety analysis; 
— Inadequate and ineffective exchange of important safety information both 
between operators and between operators and designers; 
— Inadequate understanding by operators of the safety aspects of their 
plant; 
— Insufficient respect on the part of the operators for the formal require- 
ments of operational and test procedures; 


— An insufficiently effective regulatory regime that was unable to counter 
pressures for production; 

— A general lack of safety culture in nuclear matters, at the national level 
as well as locally. 
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Appendix 
MEASURES TO IMPROVE THE SAFETY OF RBMK PLANTS 


It is reported that organizational and technical measures to improve the safety 
of operating RBMK plants were developed immediately following the Chernobyl 
accident. These included placing restrictions on the remaining RBMK plants, the 
implementation of changes that had earlier been seen as necessary, and other changes 
that were clearly beneficial in terms of safety. 

Firstly, INSAG has been told that measures had been developed and 
implemented that were aimed at: 


— Reducing the positive steam (void) coefficient of reactivity and the effect on 
reactivity of complete voiding of the core; 


— Improving the speed of the scram system; 


— Introducing new computational codes for the ORM, with numeric indication 
of the ORM in the control room; 


— Precluding the possibility of bypassing the emergency protection system while 
the reactor is at power, through an operating limit requirement and the 
introduction of a two key system for the bypass action; 


— Avoiding modes of operation leading to reduction of the departure from 
nuclear boiling (DNB) margin for the coolant at reactor inlet (this addresses 
the question of adequate subcooling at the core inlet). 


INSAG has also been told that a reduction of the void coefficient of reactivity 
has been provided by the installation of additional fixed absorbers (up to 90 pieces) 
into the core, and through introduction of the use of fuel with 2.4% 2350 enrich- 
ment in all RBMK reactors. All 1000 MW(e) reactors have been provided with the 
amount of more highly enriched fuel that is necessary to compensate for the addi- 
tional fixed absorbers, and the transition to use of only the higher enrichment fuel 
is to be completed. Parenthetically, INSAG notes that the benefit of the increase in 
fuel enrichment will only be retained if there is no extension of fuel burnup beyond 
that customary in the past. If the added fuel enrichment were to be used to extend 
fuel life, the fuel at end of cycle would contain less 2350 and more 23ЭРи, and this 
would act to increase the positive void fraction. 

It is claimed that the ORM has been increased in this way to between 43 and 
48 control rods, depending on the reactor. 

INSAG has been told that existing control and safety rods have been replaced 
by new ones of an improved design which would not leave water columns towards 
the bottom and which have longer absorbing sections. 

INSAG has been informed that the speed of insertion of control and safety rods 
has been increased, with the time required for full insertion into the core being 
reduced from 18 s to 12 s. 
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INSAG has been told that a Fast Acting Emergency Protection (FAEP) system 
has been installed at all operating reactors. This system includes 24 additional safety 
rods. The FAEP is meant to ensure that on demand, a negative reactivity of more 
than 28 (where В is the delayed neutron fraction) will be inserted in less than 2.5 s. 
The value of 28 was calculated conservatively to cover any reactivity addition 
associated with complete loss of coolant from the reactor. INSAG is told that all 
ВВМК reactors are now equipped with the FAEP system. 

Measures to reduce the void coefficient and to increase the rate of reactivity 
reduction on scram could also be of benefit in connection with uncontrolled power 
increase in the event of a loss of coolant water. 

INSAG has been informed that operating instructions have been updated to 
take into account lessons learned from the Chernobyl accident and the measures 
taken to improve RBMK plant safety. Among the new provisions is one which now 
sets a lower limit of 700 MW(th) for steady operation of an RBMK reactor. 

It has been reported that other measures have also been taken to improve the 
capability for mitigation of the consequences of an accident. These are covered in 
the report by the Working Group of USSR Experts (Annex II). 
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Аппех 1 


REPORT ВУ A COMMISSION TO THE USSR STATE COMMITTEE 
FOR THE SUPERVISION OF SAFETY IN INDUSTRY 
AND NUCLEAR POWER! 


Causes and Circumstances of the Accident at Unit 4 
of the Chernobyl Nuclear Power Plant on 26 April 1986 
(Moscow, 1991) 


The report, submitted by a Commission at the request of the State Committee 
for the Supervision of Safety in Industry and Nuclear Power (SCSSINP), concludes 
that the Chernobyl accident, which was initiated by erroneous actions on the part of 
the operating personnel, had disproportionately disastrous consequences because of 
deficiencies in the design of the reactor. This conclusion is based on an analysis of 
the findings of Soviet and foreign studies, the design information and the documenta- 
tion on technical standards. 

The Commission believes that the analysis of the causes and circumstances of 
the accident should be continued and that appropriate measures should be taken to 
improve the safety of nuclear power plants. 

The Commission was set up by SCSSINP Order No. 11 of 27 February 1990. 


Bagdasarov, Yu.E. 

Kuznetsov, A.G. 
Miroshnichenko, M.I. 

Petrov, V.A. (Deputy Chairman) 
Shteynberg, М.А. (Chairman) 
Zhuravlev, A.D. 


The Commission acknowledges the active participation in the preparation of 
the report of N.M. Afanas'ev, A.M. Bukrinskij, Yu.A. Kamenev, V.A. Kanajkin, 
N.V. Karpan, V.V. Lomakin, V.A. Orlov, V.M. Tarasenko and many other experts 
who provided very helpful contributions to the discussions of the issues covered in 
the report. The Commission would also like to thank A.S. Lazarev for all the work 
in the presentation of the report. 


1-1. INTRODUCTION 

A nuclear accident with disastrous consequences occurred at Chernobyl Unit 
4 on 26 April 1986 during experiments to test the design operation of the independent 
power supply in the event of the loss of external power sources. 


! This report was translated into English by the IAEA. 


29 


The task of dealing with the consequences of the accident has relegated the 
problem of clarifying the causes and circumstances of the accident and learning 
lessons from it to a position of secondary importance as far as the public is 
concerned. However, among experts these aspects are not yet regarded as settled. 
This fact is demonstrated by the continuing calculations and studies, as well as by 
the discussions on these issues at various national and international forums, including 
seminars and scientific and technical councils. 

Unfortunately, so far no scientific organization in the USSR has published a 
thoroughly substantiated comprehensive account explaining how the accident origi- 
nated and developed. As a result, the public continues to be very suspicious about 
reactors of the Chernobyl type, and all assurances that such an accident could not 
possibly happen again merely sound like the assurances in the not so distant past 
about the high safety levels of the RBMK-1000 reactor. 

The Commission, set up by the USSR State Committee for the Supervision of 
Safety in Industry and Nuclear Power (SCSSINP), has attempted to analyse and 
make generalizations from the documentation and reports that are available on the 
accident. The official account of the accident, which was approved by the Govern- 
ment Commission and formed the basis of the report (information) presented by the 
USSR at the IAEA meeting of experts from 25 to 29 August 1986 in Vienna [1], 
suggests that the primary cause of the accident was an extremely improbable combi- 
nation of violations by the unit personnel of operating instructions and procedures. 
A year later a Soviet report entitled The Accident at the Chernobyl Nuclear Power 
Plant: One Year After [2] presented at the IAEA International Conference on 
Nuclear Power Performance and Safety (Vienna, 28 September-2 October 1987) 
also confirmed the official account. However, an analysis and comparison of those 
reports raises a number of questions casting doubts on the credibility of this account. 

A report by the I.V. Kurchatov Institute of Atomic Energy [3], approved after 
presentation of the report [1] to the IAEA, states that: ‘‘the primary cause of the acci- 
dent was an extremely improbable combination of violations by the unit personnel 
of operating instructions and procedures, in the course of which deficiencies in the 
design of the reactor and the control rods of the control and protection system 
emerged’’ (no words are italicized in the official version). Moreover, as is stated in 
the same report [3]: ‘‘...it is fairly obvious that the only version that does not con- 
tradict the available data is the version that deals with the effect of the control rod 
displacers. '' These contradictions are sufficient grounds for continuing the analysis 
of the causes and circumstances of the accident in order to establish the truth and 
to develop measures based on facts to prevent similar accidents from occurring in 
future. 

In accordance with the responsibilities of the supervisory-regulatory body 
(SCSSINP), the members of the Commission focused their attention on examining 
and evaluating whether the reactor design and actions of the operating personnel 
complied with the requirements of the technical standards and operating documenta- 
tion in force at the time of the design and operation of Chernobyl Unit 4. They tried 


30 


to determine why the actions taken by the personnel caused the disaster, particularly 
since they were taken not by one person alone but by a whole shift. 

The results of an analysis of the personality and sociopsychological charac- 
teristics of the Chernobyl plant personnel before and after the accident are presented 
in publications by the Prognoz Psychological Research Laboratory of the USSR 
Ministry of Nuclear Power and Industry [4-6]. The analysis showed that the 
differences between the data on the personalities of the operating personnel at the 
Chernobyl plant and those of personnel at other plants were not such as to have been 
a direct cause of the accident. As a whole, the Chernobyl personnel in 1986 were 
characterized as a fairly typical, mature and stable group of specialists with qualifica- 
tions regarded in the USSR as satisfactory. They were no better, but no worse, than 
the personnel at other nuclear plants. 

This suggests that the personnel at the Chernobyl plant did not have any 
extraordinary characteristics which could account for the violations and errors that 
occurred. It is therefore essential to continue to analyse the causes and circumstances 
of the accident in order to establish whether the accident really occurred as a result 
of ‘‘a highly improbable combination of violations of operating instructions and 
procedures’’ or whether the causes of the accident were a combination of deficiencies 
in the design of the reactor for which the designers were responsible and erroneous 
actions on the part of the personnel. 

In accordance with established international and national practice, the design 
of nuclear facilities and their components has to comply strictly with special safety 
standards and regulations. In the aforementioned reports, no indication is given of 
whether an expert review of the design of RBMK reactors in general, and of 
Chernobyl Unit 4 in particular, was conducted to see whether they comply with the 
safety standards and regulations. In sifting through the available documentation, the 
Commission found that some of the engineering defects in the RBMK-1000 reactor 
design and violations of the safety standards and regulations had already been 
realized by the end of May or beginning of June 1986. This information is contained 
in various reports presented to the Government Commission. However, the defects 
identified in the reactor design and its unsatisfactory physical parameters have not 
been widely publicized among the scientific community and general public in the 
Soviet Union. They were also not included in the papers presented to the IAEA. 
Much earlier, on 28 December 1984, the Interdepartmental Science and Technology 
Council on Nuclear Power approved proposals made by expert commissions Nos 4 
and 5, which were set up by the Council to develop measures to bring existing 
RBMK-1000 units partially into line with the safety standards and regulations. 
Regrettably, however, the expert commissions ignored certain characteristics of the 
RBMK-1000 reactor which, as it turned out, played an important role in the initiation 
and subsequent development of the accident on 26 April 1986. 

This report considers only those design features which may have caused the 
accident, played a role in its development or affected its consequences. The Commis- 
sion found it necessary to draw attention to the way in which design defects affected 
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the quality of the operating documentation used by the personnel in running the unit. 
Some consideration is given to the measures and requirements which were 
introduced at all plants with RBMK-1000 reactors immediately after the accident and 
subsequently as more sophisticated improvements become available. These changes 
can be seen as evidence of earlier deficiencies in reactor design. The Commission 
draws attention to the discrepancy between the scope and substance of these 
measures and the official version which attributes the causes of the accident solely 
to personnel errors. 


1-2. BRIEF DESCRIPTION OF THE DESIGN OF CHERNOBYL UNIT 4 


By a decree of 29 September 1966, the USSR Council of Ministers approved 
a plan for the introduction of a generating capacity of 11.9 GW at nuclear power 
plants for the period 1966-1977, including 8 GW at plants with RBMK-1000 
reactors. The decree approved the construction of the Leningrad plant, the first in 
the series of plants with RBMK-1000 reactors, proposed by the USSR State Planning 
Committee, the USSR Ministry for Intermediate Sized Machinery and the USSR 
Ministry of Power. The Ministry for Intermediate Sized Machinery was to be 
responsible for the plant's construction and the Ministry of Power for its operation. 
Under this decree, the Ministry for Intermediate Sized Machinery was given respon- 
sibilities for the scientific management of the design of the reactor units and research 
and development work; for providing the manufacturers with working drawings; 
for the designs adopted; for the scientific management of the startup of the reactors 
and bringing their parameters in line with the design values; for the fabrication and 
supply of fuel to the nuclear power plants; and for reprocessing of the spent fuel. 
The Ministry of Power was made responsible for the overall design, construction and 
operation of the plants. 

Siting of the Chernobyl plant was based on a technical and economic report 
entitled Siting of the Central Ukrainian Nuclear Power Plant, prepared by the Kiev 
Department of the Teploehlektroproekt Institute and the Kiev Department of the 
Ehnergoset’proekt Institute. Two sites were proposed in the report: the village of 
Ladyzhino, in the Vinnitsa province, and the village of Kopachi, in the Kiev 
province. 

On 4 March 1966 the Council of Ministers of the Ukrainian SSR decided to 
site a fossil fuel power plant at Ladyzhino. On 15 March 1966 the USSR Ministry 
of Power approved the siting of the Central Ukrainian nuclear power plant at 
Kopachi. On 18 January 1967 the Ukrainian State Planning Committee agreed to the 
siting of the plant near the village of Kopachi, in the Kiev province, and called it 
the Chernobyl nuclear power plant. On 2 February 1967 a joint decree passed by 
the Central Committee of the Communist Party of the Soviet Union and the USSR 
Council of Ministers confirmed the decision taken by the Ukrainian State Planning 
Committee. 
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The Urals Department of Teploehlektroproekt was given the task of developing 
the design specifications for the construction of the 2000 MW Chernobyl plant. 
The design specifications were approved by the USSR Ministry of Power on 
29 September 1967. Three alternative design specifications were prepared: 


— for an RBMK-1000 reactor; 
— for a gas cooled RK-1000 reactor; 
— for a WWER-1000 reactor. 


The design specifications indicated that the engineering and economic factors 
for the first option were the worst, but that the state of development and the availabil- 
ity of equipment for that option were more satisfactory than for the other options. 


On 21 September 1968, the Ministry of Power and the Ministry for Intermedi- 
ate Sized Machinery jointly approved the design specifications for the gas cooled 
graphite reactor. However, subsequently, owing to the better equipment availability, 
the Ministries changed their decision and on 19 June 1969 decided in favour of a 
plant with an RBMK-1000 reactor. The reworked design specifications were 
approved by the USSR Council of Ministers on 14 December 1970. An order by the 
USSR Ministry of Power on 30 March 1970 entrusted the Gidroproekt Institute with 
all further work on the design of the Chernobyl plant. In accordance with the USSR 
Council of Ministers’ decree of 29 June 1966, the All-Union Research and Design 
Institute for Integrated Power Technology (of the Ministry for Intermediate Sized 
Machinery), as a subcontractor of the General Designer (the Gidroproekt Institute), 
developed the reactor design for the first stage of the Chernobyl plant. 


A feasibility study to expand the Chernobyl plant to 4000 MW was approved 
by the Science and Technology Council of the Ministry of Power on 30 March 1972. 
A joint decision by the Ministry of Power and the Ministry of Intermediate Sized 
Machinery regarding the design and construction of the Smolensk plant and the 
second stage of the Chernobyl plant was taken on 4 January 1974. Under that deci- 
sion, Gidroproekt and the All-Union Research and Design Institute for Integrated 
Power Technology were made jointly responsible for the design. The technical design 
of the second stage of the Chernobyl plant was developed by Gidroproekt and exam- 
ined by the USSR State Committee on Construction and the USSR State Planning 
Committee, which sent it to the USSR Council of Ministers on 30 September 1975 
with a joint letter. The Council of Ministers then approved the technical design by 
its decree No. 2638 R of 1 December 1975. 


The technical design of the RBMK-1000 reactor for the Leningrad plant, which 
was the first in the series, was developed by the Scientific Research and Design 
Institute for Power Technology following instructions from the Ministry for Inter- 
mediate Sized Machinery and was approved by the Science and Technology Council 
of this Ministry in October 1967 [7]. The technical design of the RBMK reactor was 
not redeveloped or revised for any of the subsequent units. 
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1-3. VIOLATIONS OF SAFETY STANDARDS AND REGULATIONS IN 
THE DESIGN OF CHERNOBYL UNIT 4 


This part of the report describes some of the ways in which Chernobyl 
Unit 4 violated the Nuclear Safety Regulations for Nuclear Power Plants (NSR) [8] 
and the General Safety Provisions for the Design, Construction and Operation of 
Nuclear Power Plants (GSP) [9] that were in force at the time of the plant’s design 
and construction. Article 1.1.4 of GSP-73 states that: *'the scope of the requirements 
of the General Safety Provisions which shall apply to newly designed nuclear power 
plants with RBMK-1000 and WWER-440 reactors shall be determined for each 
specific power plant or a group of plants by a special resolution of the organization 
which approved the General Safety Provisions.’’ The resolution of 2 July 1975 on 
safety in the design of the second stages of the Kursk and Chernobyl plants states 
that designers must observe the safety standards in force at the time, i.e. GSP-73 and 
NSR-04-74. The Commission cites only those violations of the aforementioned docu- 
ments which played a role in the initiation and development of the accident on 
26 April 1986. In order to facilitate the presentation of the findings, the wording of 
the relevant articles of the regulations is given, then reference is made to the viola- 
tions in question and finally the substance of the violations is described. 


I-3.1. 


Article 3.1.6 of NSR-04-74 states that: ‘‘In the technical design of a nuclear 
power plant, the design documents relating to nuclear safety must be included 
as a separate part in the technical safety report on the construction and opera- 
tion of the nuclear power plant. Note: All violations of the regulations are to 
be included in this part. Any violations must be authorized by the USSR State 
Committee for the Supervision of Nuclear Power Safety at the technical design 
stage." 


The technical design documentation for the second stage of the Chernobyl plant 
(Units 3 and 4), developed by the General Designer (Gidroproekt) in 1974 [10], 
contained the Technical Safety Report for the Chernobyl plant, approved by the 
Scientific Manager (I. V. Kurchatov Institute of Atomic Energy) and Chief Design 
Engineer (Scientific Research and Design Institute for Power Technology). The 
Nuclear Power Plant Technical Safety Report [11] was prepared with account taken 
of both the Technical Safety Report for the RBMK Four Reactor Facility [12], 
developed by the Scientific Research and Design Institute for Power Technology, 
and the Technical Report of Glavatomehnergo, USSR Ministry of Power [13]. 

No list of violations of the regulations in the design of the plant or of the reactor 
facility for the second stage of the Chernobyl plant was given in any of the aforemen- 
tioned design documents. Furthermore, no analysis was made of the acceptability of 
these violations and they were not authorized by the State Committee for the Super- 
vision of Nuclear Power Safety: ‘‘There were at least two weak points in the RBMK 
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design: the positive void coefficient of reactivity and the emergency protection 
system which, when the operating instructions were violated, did not shut down the 
reactor fast enough, and in some cases could even briefly increase its power’’ [14]. 
Both of these ‘weak points’ were the result of violations of the safety standards and 
regulations and they are considered in the following. Since officially there were no 
violations, no technical and organizational measures were developed to compensate 
for them. 

The plant Technical Safety Report [11] was approved by the Department for 
Nuclear Power Supervision of the USSR State Committee for the Supervision of 
Safety in the Mining Industries (Letter of 5 March 1975, No. 24-11/73), by the 
USSR State Committee for the Supervision of Nuclear Power Safety (Letter of 
18 May 1975, No. H18) and by the USSR State Committee for Public Health Super- 
vision (Letter of 20 January 1975, No. 32-57). 


Note: Until 1984 the State Committee for the Supervision of Nuclear Power 
Safety was a division of the USSR Ministry for Intermediate Sized Machinery. 


The Commission concludes that the requirements of Article 3.1.6 of 
NSR-04-74 were not met by the designers of the Chernobyl plant and reactor, and 
notes that since the Technical Safety Report did not contain a list of the violations 
of the safety standards and regulations or measures to compensate for those viola- 
tions, the operating documentation used by the personnel to run the plant could not 
possibly correspond to the actual parameters of the reactor. 


I-3.2. 


Article 3.2.2 of NSR-04-74 (as well as Article 2.2.3 of GSP-73) states that: 
“When designing the reactor it is desirable to ensure that the total power 
coefficient of reactivity is not positive under any operating conditions. If the 
total power coefficient of reactivity becomes positive under any operating con- 
ditions, the nuclear safety of the reactor during steady state, transient and 
emergency operating conditions must be guaranteed in the design and explicitly 
proved. '' 


The void coefficient of reactivity a, is the dominant component of the total 
power coefficient of reactivity of RBMK reactors and numerically reflects changes in 
reactor reactivity as a result of changes in the steam quality in the core. It was origi- 
nally foreseen in the design of the RBMK-1000 that with the uranium-graphite ratio 
that was selected, when the fuel burnup fraction corresponded to steady state refuel- 
ling conditions, the void coefficient of reactivity would have a high positive value. 
These high positive values for the void coefficient of reactivity were the result of a 
desire to attain large fuel burnups (i.e. high economic efficiency). It was intended 
that the region of reactor stability would be guaranteed in the range of void coeffi- 
cients of reactivity of —3.2 x 10% dk/k to + 9.6 х 10% ók/k. This coefficient 
depends largely on the lattice pitch of the core and the core composition (number 
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of control rods submerged in the core, number of additional absorbers installed, fuel 
enrichment and fuel burnup). 


The void coefficient of reactivity a, and the total power coefficient ay of 
reactivity were determined experimentally using the applicable techniques, begin- 
ning with the startup of Leningrad Unit 1, i.e. from 1973. 

For reactors with fuel enriched to 1.8% in uranium-235, the experimental data 
showed that the void coefficient of reactivity increased as a function of fuel burnup 
and removal of additional absorbers (AA): 


(а) from —0.228,. (211 AA) to + 5.16, (32 AA) at Leningrad Unit 1 [15]; 
(b) from —0.168, (215 AA) to + 4.9В.г (39 AA) at Chernobyl Unit 1 [16]; 
(c) from —0.38Вен (179 AA) to + 5.3ßeff (40 AA) at Chernobyl Unit 2 [16]. 


It was confirmed experimentally that as œ, increased, there was a decrease іп 
the time taken for the development of the first azimuthal harmonics, which is a very 
important parameter characterizing the stability of the reactor power density field 
and the ability of operating personnel to control the reactor effectively. When a, 
was about +5Вет, this time decreased to 3 min, making the reactor unstable and 
difficult to control. 


In order to improve reactor stability, it was decided in 1976 to convert the 
ВВМК reactor to fuel enriched to 2% in uranium-235 enriched fuel and to install 
a local automatic control system. Second generation plants with the RBMK-1000 
reactor (Leningrad Units 3 and 4, Kola Units 3 and 4, Chernobyl Units 3 and 4, 
Smolensk Units 1 and 2) were loaded from the beginning with fuel enriched to 2% 
in uranium-235. However, even with that fuel enrichment, as fuel burnup increased 
to 1100-1200 MW -d/t per fuel assembly and with an authorized operating reactivity 
margin (ORM) corresponding to 26-30 manual control rods, the void coefficient of 
reactivity approached +5£.;. There were similar fuel burnups at Chernobyl Unit 4 
before the accident. 


The Commission notes that all the aforementioned data relate to reactor power 
levels which are higher than 50% of the nominal level. There were no calculations 
or experimental data on the value of a, for power levels of less than 50% or for 
various transient and accident conditions. 

Measurements of the fast power coefficient of reactivity, characterizing the 
change in reactor reactivity in response to a change in power, showed that when a, 
increased from —(0.2-0.4)Bepr to +58. ow changed from —4 x 10% B, 
MW(th) to +0.6 x 107* G,,/MW(th). However, these data were valid only for 
power levels of more than 50% Naom [16]. 


In view of the lack of calculations on coefficients of reactivity at power levels 
of less than 50% , the Commission is bound to conclude that the designers of the reac- 
tor evidently did not expect any dangerous characteristics in the behaviour of the 
reactor at low power levels and notes that they did not impose any restrictions on 
reactor operation at low power levels before the accident on 26 April 1986. 
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The Scientific Manager and Chief Design Engineer of the RBMK-1000 reactor 
determined the dependence of reactor reactivity on coolant density in the core using 
calculation codes in order to analyse the development of the design basis accident 
(DBA). The DBA considered in the design was a rupture in the pressure header of 
the multipass forced circulation circuit (MFCC) resulting in the loss of the water and 
steam phases of the core coolant. According to the calculated dependence, during 
coolant vaporization in the core (reduction of coolant density) the positive reactivity 
initially increases to +28.,, and then the reactivity decreases as the coolant density 
approaches zero (full steaming of the channels or coolant vaporization in the core) 
and becomes negative. This leads to the reactor shutting itself down even if the reac- 
tor control and protection system does not affect the reactivity. This was why 
problems of shutting the reactor down in the event of coolant leaks were not consid- 
ered [12]. In fact, according to calculations made in 1980, 1985 and 1987, when the 
water in the core is replaced by steam, there is an increase in positive reactivity to 
+568. [17], which leads not to the reactor shutting itself down, but to a large 
increase in positive reactivity and reactor runaway. 

There is no safety analysis of the void coefficient of reactivity in the 
RBMK-1000 design documentation. All plants with RBMK-1000 reactors therefore 
operated with values of this coefficient obtained in practice, rather than the values 
established in the design. As has already been noted, o, depends largely on the 
composition of the reactor core, which in turn depends on the specific calculation 
methods and refuelling schemes for each plant. These methods were also not ana- 
lysed in the design. 

Neither the designers, nor the plant operators, nor the regulatory body attached 
proper importance to the large positive coefficients of reactivity which became 
apparent from experiments, and they did not attempt to find acceptable theoretical 
explanations. The obvious discrepancy between the actual core characteristics and 
the projected design values was not adequately analysed and consequently it was not 
known how the RBMK reactor would behave in accident situations. 

There are a number of explanations for the poor quality of the calculational 
analysis of the safety of the design. These include the fact that, until recently, Soviet 
computer techniques were chronically outdated and the standard of computer codes 
was very low. Three dimensional non-stationary neutron-thermal-hydraulic models 
are required in order to calculate the physical parameters of an RBMK reactor under 
different operating conditions. Such models first became available only shortly 
before the Chernobyl accident and were not really developed until after the accident. 

The Commission concludes that the design of the RBMK-1000 reactor and the 
nuclear physics and thermal-hydraulic characteristics of the core predetermined the 
positive void and power coefficients of reactivity under steady state refuelling condi- 
tions. The nuclear safety of the reactor with such coefficients was not ‘‘guaranteed 
and explicitly proved’’ either for operation at rated power ог for intermediate power 
levels ranging from the minimum controllable power level to the rated level. This 
was also not done for transient and accident regimes. As a result of the misguided 
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selection of the core’s physical and design parameters Бу the designers, the 
RBMK-1000 reactor was a dynamically unstable system with regard to power and 
steam quality perturbations. The steam quality, in its turn, was dependent on many 
parameters characterizing the reactor state. 

The Commission concludes that the design and characteristics of the core of 
the RBMK-1000 reactor violated the requirements of Article 3.2.2 of NSR-04-74 
and Article 2.2.3 of GSP-73. 


І-3.3. 


Article 3.1.8 of NSR-04-74 states that: ''The reactor alarm system must 
produce the following signals: Emergency signals (optical and audible signals, 
including an emergency siren), when the parameters reach the point at which 
the emergency protection system (EPS) is triggered and when accident devia- 
tions in the operating conditions occur; warning signals (optical and auditory 
signals), when the parameters approach the EPS trip point, when the radiation 
level exceeds the established limits, and when normal operation of equipment 
is impaired. '' 


It is well known that both the information [1] and report [2] presented by the 
USSR State Committee on the Utilization of Atomic Energy to the IAEA identify 
the main personnel error as operation of the reactor with an ORM below the estab- 
lished limit. However, the design documentation and research work conducted to 
analyse the design made no provisions for the ORM to be treated as a parameter 
which would trigger the alarm system or the EPS when it reached the limit value. 
Only after the accident, in the Summary of Measures to Improve the Safety and 
Reliability of Nuclear Power Plants with RBMK Reactors in Operation or under 
Construction (18] was mention made of the development of an ORM recorder with 
a display on the control board, and an instrument to produce an emergency signal 
to shut down the reactor if the ORM reached the emergency trip point. 

Similarly, the design made no provisions for an alarm system or a protection 
system for what were referred to as violations of permissible limits for a number of 
other parameters. In some cases, as a result of incorrect design decisions, the protec- 
tion systems did not operate over the whole range of possible reactor operating 
conditions (see section 4.7.4 of this report) [Section 1-4.7.4]. 

The Commission concludes that for a number of the most important 
parameters, violations of which on 26 April 1986 were considered by the reactor 
designers to have played a critical role in the initiation and development of the acci- 
dent, no emergency or warning signals were provided in the design. This is a clear 
violation of Article 3.1.8. of NSR-04-74. 
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1-3.4. 


Article 3.3.1 of NSR-04-74 states that: ‘‘The reactor control and protection 
system must ensure that the power (chain reaction rate) is reliably controlled, 
that the chain reaction is controlled and can be swiftly terminated and that the 
reactor is maintained in a subcritical state. ” 


The RBMK emergency protection system (EPS) was designed to compensate 
for the following reactivity effects [19]: 


— coolant vaporization in the fuel channels in a cold reactor state; 
— steam collapse in the core when the fuel elements cool to 265?C; 
— the possible sticking of some of the emergency protection rods. 


The RBMK-1000 designers considered that it was sufficient to take only these 
reactivity effects into account when designing the EPS. However, these effects do 
not cover a wide range of different effects which were already known at the early 
stages of development of the reactor. In particular, the designers ignored the fact that 
the power and void coefficients of reactivity vary over a wide range from negative 
to positive values as a function of the core composition and the reactor operating con- 
ditions. They also ignored the fact that the design of the control rods was such as 
to predetermine an initial increase in positive reactivity as they start to move into 
the core from the upper limit position. The slow speed of the emergency protection 
system (the time for total insertion into the core from the upper limit position is 
18 s) and defects in the design of the rods (i.e. the positive reactivity excursion) 
resulted in a situation where, for a number of reactor operating modes, the EPS not 
only did not function, but itself initiated a reactor runaway. 

There are grounds to think that the reactor designers did not assess the effec- 
tiveness of the EPS in the possible operating modes. Research [20] conducted after 
the accident has shown that the reactivity introduced into the core by the control rods 
largely depends on the ORM. When the ORM is about 30 effective manual control 
rods (approximately 100 control rods, each lowered to the 1.4 m level), a strong 
negative reactivity is introduced. When the ORM is about 15 control rods, during 
the first six seconds after triggering of EPS-5, less than Вен of negative reactivity 
is introduced into the core. In the case of a non-regulation ORM of 7 control rods, 
during the first eight seconds after triggering of EPS-5 the inserted reactivity is posi- 
tive (i.e. the chain reaction is being accelerated rather than terminated). The 
designers were evidently not sufficiently aware of this fact before the accident, other- 
wise it is difficult to believe that they could have expected to ensure safety by 
organizational measures such as prohibiting reactor operation at low ORMs given the 
parameters of the EPS just stated. 

The problem of ensuring that the power (chain reaction rate) of the 
RBMK-1000 reactor is reliably controlled needs to be considered. Two systems are 
designed to ensure power control: the physical power density distribution control 
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system (PPDDCS), which has sensors located inside the core, and the reactor control 
and protection system (RCPS), which has sensors located both in the lateral biologi- 
cal shield tank and inside the core. In principle, the systems were designed to com- 
plement each other. However, both systems have significant deficiencies which are 
most apparent at low power levels. This is because the PPDDCS was designed to 
control the relative and absolute power density distributions in the range of 
10-120% of the nominal levels and to control the total reactor power in the range 
of 5-120% of the nominal level. The local automatic control and local automatic 
protection system (LAC-LAP), which received signals from the ionization chambers 
inside the core, controlled the reactor at power levels greater than 10% of the nomi- 
nal level. It is very difficult to control such a large reactor as the RBMK-1000 (core 
diameter 11.8 m, height 7.0 m) at low power levels using only the lateral ionization 
chambers. This is because at low power levels, when the LAC-LAP system is 
switched off, the lateral ionization chambers do not provide signals for the central 
parts of the reactor core and, moreover, do not indicate the axial power density 
distribution, since all the ionization chambers are located at the mid-plane of the 
core. Thus, at low power levels a reactor operator has to operate ‘blindly’, relying 
more on experience and intuition than on the readings of the control instruments. 
Although ‘blind’ control of the RBMK-1000 is to some extent acceptable during 
startup of a poison free reactor when its power density field is controlled in accor- 
dance with preliminary calculations, the situation is different when a non-uniformly 
poisoned reactor is being shut down. In this case, there is a risk of large field distor- 
tions and critically high non-uniformities of both the axial and radial power density 
distributions. These facts were not taken into account before the accident and, unfor- 
tunately, no limitations were imposed on reactor operation at low power levels. 
The Commission concludes that the reactor control and protection system of 
the RBMK-1000 did not meet the requirements of Article 3.3.1 of NSR-04-74 in the 
context of the actual reactor reactivity effects and the design of the RCPS rods. 


1-3.5. 


Article 3.3.5 of NSR-04-74 states that: ‘‘At least one of the planned systems 
for controlling reactivity must be able to bring the reactor to a subcritical state 
and maintain it in this state under any normal or accident conditions, even if 
one of the most efficient reactivity control mechanisms does not work. '' 


The Commission considers that, as has been shown in section 3.4 of this report 
[Section 1-3.4], miscalculations by the reactor designers in determining the reactivity 
effects which needed to be taken into account in the design of the reactor control and 
protection system meant that the requirements of Article 3.3.5 of NSR-04-74 were 
inevitably violated. 


I-3.6. 


Article 3.3.21 of NSR-04-74 states that: ''The reactor control and protection 
system must include a fast response emergency protection system (class I EPS) 
which ensures automatic shutdown of the reactor in the event of an accident 
situation. The signals and trip points for the emergeny protection iem must 
be analysed in the design documentation.’ 


No safety analysis of the fast response emergency protection system is made 
in the RBMK-1000 design documentation. The time of insertion into the core was 
the same for all the RCPS rods (18-21 s). This means that their division into func- 
tional groups of emergency protection rods and manual control rods was a notional 
one. During reactor operation, an emergency protection system rod could be con- 
verted into a manual control rod and vice versa without any technical or organiza- 
tional problems. The aforementioned response parameter was not fast enough for a 
reactor with a large positive reactivity feedback. It can be presumed that no studies 
were carried out to determine the required speed of response of the EPS rods in order 
that the time of core insertion be less than 18 s because the reactivity effects were 
poorly understood and no thorough analysis had been made of emergency operating 
conditions, including those with low initial power levels. 


Note: Authors of the information [1] submitted to the IAEA note that ‘‘the 
RBMK reactors are fitted with a large number of independent regulators, 
which are inserted into the core at a rate of 0.4 m/s when the emergency pro- 
tection system is triggered. The comparatively slow motion of the regulators 
is offset by their large number.’’ The mistakenness of this view was high- 
lighted by the very accident on the subject of which the aforementioned infor- 
mation was prepared. After the accident, a fast response emergency protection 
system with a time of 2.5 s for total insertion of the rods into the core was 
developed and installed. 

The Commission notes that the requirements of Article 3.3.21 of NSR-04-74 

were not met in the design. 


I-3.7. 


Article 3.3.26 of NSR-04-74 states that: ''The reactor's emergency protection 

system must ensure that the chain reaction is automatically, quickly and relia- 

bly terminated in the following cases: 

— When the trip point of the emergency power protection system is reached; 

— When the trip point of the emergency power (or reactivity) increase rate 
protection system is reached; 

— In the event of failure of the voltage supply to the RCPS bus bars; 

— In the event of failure or unavailability of any two of the three channels of 
the power protection system or of the power increase rate protection system; 
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— In the event of emergency signals requiring reactor shutdown; 
— When the emergency protection buttons are pressed.” 


As has been shown earlier, the RCPS of the RBMK reactor, including the EPS, 
was not designed to meet the requirements of this Article of the Regulations. The 
list of emergency signals was incomplete and did not ensure that the reactor protec- 
tion system would be triggered when certain parameters reached dangerous levels 
(for example, the parameters related to the operational reactivity margin, low power 
level, and so on). 


In addition, it should be noted that the insertion of the RCPS rods into the core 
from the upper position following actuation by an emergency signal or by pressing 
the button of the emergency protection system could, depending on the core compo- 
sition, power density field distribution and operating mode, produce precisely the 
opposite effect, as a result of design deficiencies in the RCPS rods and the physical 
parameters of the core. In other words, it could introduce positive reactivity, rather 
than terminate the chain reaction quickly and reliably (see section 4 of this report 
[Section 1-4]). Section 4.6.3 [Section 1-4.6.3] of the report shows that, given the 
design characteristics of the reactor and RCPS, the increase in reactor power follow- 
ing triggering of EPS-5 might, under certain conditions, be so large that when the 
trip points for the power emergency protection system and emergency power 
increase rate protection systems were reached, it would no longer be possible to 
terminate the nuclear reaction without substantial damage to the fuel elements. 
In view of the reactor's poor characteristics for dumping steam from the reactor 
space, this predetermines its possible destruction. 


The design did not provide the reactor space with a protection system against 
multiple ruptures of the fuel channels. A rupture of more than one of the fuel 
channels could, therefore, cause lifting of the reactor cover plate and upper structure 

- of the reactor (structure E), followed by failure of the whole RCPS rod insertion 
system and even withdrawal of the RCPS rods from the core. This leads to the 
introduction of positive reactivity, not to a fast and reliable termination of the chain 
reaction. 


The Commission concludes that the design of the RCPS for the RBMK-1000 
reactor did not comply with the requirements of Article 3.3.26 of NSR-04-74. 


I-3.8. 


Article 3.3.28 of NSR-04-74 states that: ''The number, location, efficiency and 
insertion rate of the actuating mechanisms of the EPS must be determined and 
analysed in the reactor design documentation, where it must be shown that, 
under any emergency operating conditions and even without the operation of 
one of the most efficient actuating mechanisms, the actuating mechanisms of 
the EPS are able to guarantee that: 
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— In an emergency, the rate of reactor power reduction is high enough to pre- 
vent the possibility that damage to the fuel elements will exceed the per- 
missible limits; 

— The reactor can be brought to a subcritical state and maintained in this 
state, taking into account possible reactivity increases, for long enough to 
enable other slower actuating mechanisms of the RCPS to be introduced; 

— No local critical masses are formed. '' 


The design of the RCPS for the RBMK-1000 reactor seriously violated this 
Article at the time of the accident in 1986. The number, efficiency and insertion rate 
of the EPS actuating mechanisms were selected and analysed without account being 
taken of the theoretically predicted and experimentally confirmed reactivity effects 
which could be (and were in the Chernobyl accident) disastrous. 

The evolution of the design of the RBMK-1000 reactor is of interest as far as 
the determination and analysis of the number and efficiency of the reactivity control 
mechanisms are concerned. 

In the RBMK draft design documentation [7], developed in 1965, 212 RCPS 
rods and fuel enriched to 2% in 2350 were foreseen, whereas 179 RCPS rods and 
fuel enriched to 1.8% in 2350 were accepted in the technical design. The draft 
design provided for RCPS rods in the RCPS with a 7 m long absorber and displacer 
(i.e. completely covering the core), 68 of which were EPS rods. However, in the 
technical design the length of the absorber was only 6 m for 146 rods, 5 m for 
12 rods and 3 m for 21 rods. The number of EPS rods was reduced to 20 with an 
absorber length of 6 m. In the final working design there were 179 RCPS rods with 
an absorber length of 5 m (except for the 21 shortened absorber rods with a 3.5 m 
long absorber). There were 21 EPS rods for the first stage RBMK reactors, and 
24 for the second stage. For the second stage reactors, the total number of RCPS 
rods was increased to 211 without any change in design. Thus, as a result of a long 
evolutionary process, a design for the RCPS rods was selected in which the reactivity 
control. mechanisms did not prevent the formation of local critical masses, since by 
virtue of their design they did not cover the entire height of the core (according to 
data presented in Ref. [21], the critical height of the RBMK-1000 core varied from 
0.7 m to 2.0 m for different states of the core). 

Since the absorbing capacity of the graphite displacer, which is connected to 
the rod via a ‘telescope’, is lower than that.of the water being forced out of the lower 
part of the channel when an RCPS rod moves down from the upper position, local 
introduction of positive reactivity in the lower part of the core occurs. At a particular 
core composition and power density field profile, this could cause the formation of 
a local critical mass. 

The Chief Design Engineer [22] and the Scientific Manager knew about this 
effect before the accident. It was discovered experimentally in November/December 
1983 during the physical startup of Ignalina Unit 1 and that of Chernobyl Unit 4, 
i.e. almost two-and-a-half years before the Chernobyl accident [23]. The Physical 
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Startup Commissions proposed some measures to eliminate these negative effects, 
but none of them were implemented before the accident. The proposals included: 
limitations on the withdrawal of the manual control rods to their upper limit stop 
switches; the improvement of the design of the RCPS rods to exclude the lower water 
column; and the introduction of water film cooling in the channels of the RCPS. The 
Scientific Manager drew attention to the extremely dangerous nature of this effect. 
In particular, it was noted that ‘‘When the reactor power decreases to 50% (for 
example, when one of the turbines is switched off), the reactivity margin is reduced 
as a result of poisoning and distortions of the axial field are observed up to [power 
peaking factor} K, ~ 1.9. Triggering of the EPS in this case may lead to the 
introduction of positive reactivity. It seems likely that a more thorough analysis will 
reveal other dangerous situations” [24]. 

The following proposals were then made, which, had they been implemented, 
might have prevented the Chernobyl accident on 26 April 1986: 


— That the design of the RBMK manual control and EPS rods should be improved 
to exclude the water column under the displacer when the rods are in the upper 
position; 

— That the transient and accident operating conditions of the RBMK should be 
analysed carefully, taking the actual calibrated characteristics of the RCPS 
rods into account; 

— That until the aforementioned steps have been taken, changes should be made 
to the RBMK regulations so that the number of rods which may be completely 
withdrawn from the core is limited. 


The Scientific Research and Design Institute for Power Technology had recog- 
nized the possibility of a positive reactivity excursion [22] and had suggested some 
measures to offset this effect. However, the technical measures were not 
implemented by the Chief Design Engineer (those measures included increasing the 
number of shortened absorber rods, increasing the length of the 'telescope', and 
returning to the initial draft design of the RCPS with rods without displacers but with 
water film cooling in the RCPS channels). The Chief Design Engineer proposed 
organizational measures to eliminate the dangerous upper position effect of the RCPS 
and made the following recommendation: “а the number of rods which may be 
fully withdrawn from the core (up to the upper limit stop switch) should be limited 
to 150 for the RBMK-1000 reactor and that the other, partially inserted rods must 
be inserted into the core by at least 0.5 m"' [22]. 

The recommendation permitted a positioning of the RCPS rods whereby the 
breeding characteristics in the lower part of the core at a height of 1.2 m would 
increase when the rods moved simultaneously in response to an emergency protec- 
tion signal. If this recommendation had been implemented it would have been possi- 
ble to have an ORM of 3-5 manual control rods, which would have contravened the 
requirements of section 9 of the Operating Procedures, where the minimum permis- 
sible ORM is specified as 15 manual control rods. 
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One of the proposals made by the Chief Design Engineer to offset the positive 
reactivity excursion caused by insertion of the RCPS rods involved inserting short- 
ened absorber rods into the lower part of the core in response to an emergency pro- 
tection signal (proposal No. 264 of 22 February 1977). However, at most of the 
RBMK units, including Chernobyl Unit 4, this proposal was not implemented. A 
technical proposal made by the Chief Design Engineer (No. 8794) for an experimen- 
tal RCPS rod (with an absorber extended to 7 m and an extended telescope) was also 
not implemented. 

The Commission considers that the design of the RBMK-1000 reactor did not 
comply with the requirements of Article 3.3.28 of NSR-04-74. 


I-3.9. 


Article 3.3.29 of NSR-04-74 states that: ''The emergency protection system 
must be designed in such a way as to ensure that a protection action is normally 
carried out fully. The design documentation must contain an analysis of any 
cases where termination of the protection action is permitted in certain 
instances when the signal triggering the protection system disappears. '' 


The approach adopted by the Chief Design Engineer to the design of the 
reactor control and protection system is described in the Technical Design Documen- 
tation of the RBMK Reactor Control and Protection System [19], where it is stated 
that: *'the operating conditions of a power plant with an RBMK reactor connected 
to a power distribution grid where the plant's share is high make the traditional prin- 
ciple for the design of the RCPS unacceptable when an emergency signal causes 
rapid insertion of all or part of the RCPS rods to ensure a fast uncontrolled termina- 
tion of the reaction. The system developed does not make it possible to reduce the 
power abruptly, but does permit accelerated controlled reduction of power from the 
rated value to lower levels and down to those required for the plant's internal load 
and ensures steady operation of the plant at these levels.” In the same document it 
is also stated that: ‘‘Substantially new design solutions have been adopted in the EPS. 
A complete reactor shutdown by dropping all the RCPS rods is foreseen only for total 
loss of power to the plant. Under all other accident conditions, the power is reduced 
in a controlled manner to the specified levels with the required speed.” 

The Commission did not find in the design documentation any other analyses 
of the admissibility of terminating a protection action following disappearance of the 
actuating signal (from the power increase protection system or the power excursion 
rate reduction protection system). 

It can be seen from the foregoing that the reactor designers analysed the operat- 
ing algorithm of the emergency protection system in terms of the efficiency of the 
plant's operation in the power supply system, rather than in terms of its ability to 
ensure nuclear safety, which is the proper function of an emergency protection 
system. 
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The Commission concludes that the design of the RBMK-1000 did not comply 
with the requirements of Article 3.3.29 of NSR-04-74. 


I-3.10. 


Having considered to what extent the RCPS of the RBMK-1000 reactor at 
Chernobyl Unit 4 at the time of the accident complied with the safety rules, the Com- 
mission considers it necessary to stress that all the design deficiencies of the RCPS 
were in fact known before the accident. Clear technical proposals to eliminate these 
deficiencies had been made, such as: 


— to lengthen the absorber part of the RCPS rods; 

— to lengthen the telescope and displacer of the RCPS rods; 

— to install an independent fast response emergency protection system; 

— to introduce a number of new engineered protection systems; 

— to insert shortened absorber rods into the core in response to an emergency 
protection signal. 


All the above measures were already included in the ‘Summary of measures’ 
[18, 25] after the accident. They have been implemented partially and are continuing 
to be implemented at all RBMK-1000 reactors. 

The Commission notes that in addition to the aforementioned violations of 
Articles 3.1.6, 3.1.8, 3.2.2, 3.3.1, 3.3.5, 3.3.21, 3.3.26, 3.3.28 and 3.3.29 of 
NSR-04-74, in the design of the RCPS of the RBMK-1000, the design of this system, 
which is extremely important for ensuring reactor safety, also violated similar 
requirements of Articles 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.5.2 and 2.5.8 of GSP-73. 


I-3.11. 


In addition to the aforementioned violations, the design of nuclear power plants 
with RBMK reactors contained other safety significant violations of regulations. The 
Commission believes that it is necessary to focus on one of the issues that has been 
discussed most widely: namely the lack of containment at Chernobyl Unit 4. 

The fourth unit was constructed in accordance with a design developed 
when the General Safety Provisions of 1973 were in force. In accordance with 
Article 2.7.1 of GSP-73, a main coolant circuit may be located outside leaktight 
buildings provided that **should an emergency situation occur, any radioactive sub- 
stances released are localized in unused leaktight buildings or specially directed if 
the release is permitted under certain specific conditions.” Article 2.7.4 of GSP-73 
requires that ‘‘if a part of the main coolant circuit or of the auxiliary systems is 
located outside leaktight buildings, there must be design features to ensure the safety 
of the public and personnel in the event of a rupture of this part of the circuit.” 

The design of the second stage of the Chernobyl plant is such that part of the 
main coolant circuit (70 mm and 300 mm diameter pipelines) is located outside leak- 
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tight buildings. The buildings which contain this part of the circuit have special 
deflecting plates which direct the release of the radioactive steam-air mixture into 
the atmosphere in the event of rupture of the 70 mm and 300 mm diameter pipelines. 
The radiological consequence of such an accident was estimated to be a dose of 
2.1 rem [21 mSv] to a child's thyroid as a result of inhalation of iodine isotopes. 
These were the grounds given to justify the admissibility of not having a proper acci- 
dent localization system [11]. 

The possibility of more serious initial events was disregarded, including acci- 
dents in which the reactor space is ruptured and extensive fuel damage is caused by 
multiple ruptures of fuel channels, resulting in lifting of the upper reactor cover and 
upper structure of the reactor (structure E), as happened on 26 April 1986. 

The Commission thinks that it is necessary to note that there are not sufficient 
grounds for discussing whether the consequences of the accident on 26 April 1986 
would have been markedly reduced if there had been a containment shell, since no 
serious research has been done in this area. At the same time, it is important to note, 
firstly, that the lack of a proper accident localization system in the RBMK-1000 
reactor indicates that the plant safety philosophy based on the defence in depth princi- 
ple (the containment shell is the fourth barrier according to this philosophy), which 
was already widely developed and applied abroad in the 1960s-1970s, was ignored; 
and, secondly, that the Chernobyl disaster tragically confirmed the cost of violating 
the multiple containment barrier principle in the design. 


1-3.12. 


The actual status of the analysis of the nuclear safety of the reactor in 1976, 
at the time at which a supplement to the Technical Safety Report was published, is 
reflected in the resolution of 5-6 Мау 1976 by which a commission of the USSR 
Ministry of Intermediate Sized Machinery was set up to develop basic initial data for 
the design of nuclear power plants and refinements of the basic safety provisions for 
RBMK-1000 reactors. The resolution, in particular, refers to the unresolved difficul- 
ties of ensuring the temperature regime of the fuel element cladding and the fuel 
channels in the event of accidents where the normal cooling water supply is 
disrupted, taking into account factors such as the effect of an interruption in coolant 
supply, the variation in neutron power following activation of EPS-5 and release of 
additional reactivity owing to the void effect. The resolution notes that an important 
condition for ensuring safety is the fast termination of the neutron power by means 
of the emergency protection system, which would compensate for the positive reac- 
tivity released during a rapid increase of the steam quality in the core after rupture 
and would bring the reaction well below criticality. 

The position of the I.V. Kurchatov Institute of Atomic Energy is made clear 
in the same resolution, where it is stated that an additional emergency protection 
system with a faster response time should be developed to compensate for the positive 
void reactivity effect in the event of ruptures. The aforementioned commission 
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recommended that the Scientific Research and Design Institute for Power Technol- 
ogy, together with the Г.Г. Kurchatov Institute of Atomic Energy, should study the 
calculations made by the Kurchatov Institute, perform additional calculations to test 
the adequacy of the EPS, and formulate appropriate recommendations. A recom- 
mendation was also made that efforts should be made to speed up the calculational 
and experimental work to analyse the safety system, primarily, with respect to a 
change in reactivity in the event of a sharp rise in steam quality in the core. Regret- 
tably, the recommendations have still not been implemented, although there is no 
doubt about the urgency of the proposals made back in 1976. 


The aforementioned commission to develop basic initial requirements for 
the design of nuclear power plants and refinements of the basic safety provisions 
for RBMK-1000 reactors was set up after an accident at Leningrad Unit 1 on 
30 November 1975, which resulted in radioactive releases. The foregoing excerpts 
show that the members of the commission understood that the accident at the Lenin- 
grad plant (the first in the RBMK-1000 reactor series) on 30 November 1975 was 
a result of the reactor’s design characteristics, rather than personnel errors, although 
the personnel are known to have operated the plant with an ORM well below 
15 manual control rods prior to the accident on 30 November 1975. Regrettably, 
those who were in charge of the operation of plants with RBMK-1000 reactors were 
not informed of the real causes of the accident. 

The officially declared cause of the accident at the Leningrad plant, namely 
destruction of a fuel channel due to a manufacturing defect, is not very convincing 
and the foregoing recommendations made by the commission set up by the Ministry 
of Intermediate Sized Machinery in 1976 demonstrate this fact. 


In 1980, the Scientific Research and Design Institute for Power Technology 
made a study [16], which was subsequently used in the analysis of the safety of the 
third stage of the Chernoby] plant. The study lists the factors which have a significant 
effect on nuclear safety and, in particular, it notes the following: 


— An increase in the coolant flow rate through a fuel channel impairs the reac- 
tor’s dynamic properties; 

— A decrease in ORM causes a positive shift of all the coefficients of reactivity 
except the fuel temperature coefficient; 

— An increase in fuel burnup causes the coefficient of reactivity to become posi- 
tive and subsequently to increase; 

— An increase in fuel burnup causes an increase in the positive graphite tempera- 
ture coefficient of reactivity; 

— An increase in fuel burnup causes a transition from negative to positive of the 
total coefficient of reactivity; 

— Coolant vaporization in the RCPS cooling circuit gives rise to positive 
reactivity; 

— At low power levels, large irregularities in breeding properties may occur, 
which can cause large power density distortions with a power peaking factor 
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of more than 10. This will redistribute the ‘weights’ of the rods so that the effi- 
ciency of the rods in the ‘peak’ region may be tens of times higher than the 
efficiencies of those at a distance from it; 

— Variations in the axial field profile may cause a change in the weights of the 
rods which can be partially inserted; 

— The coefficients of reactivity for the whole reactor may change as a result of 
neutron field deformations and consequent redistribution of coolant flow rates 
along the channels. 


The Commission considers that the negative properties of this type of reactor 
are likely to predetermine the inevitability of emergency situations and that they cer- 
tainly do not demonstrate that such situations are likely to be extremely rare and 
would occur only in the event of an extremely improbable combination of reactor 
operating procedures and conditions adopted by the unit personnel. 


Thus, it seems that the reactor designers were well aware of the possible dan- 
gerous consequences of the reactor characteristics and understood how the safety of 
the RBMK-1000 reactor could be improved. This is confirmed by the fact that the 
main technical measures to enhance the safety of the RBMK-1000 reactor [26] were 
announced less than a month and a half after the accident. These included: 


— Installation of 30 additional absorbers in the reactor core (later the number of 
additional absorbers was increased to 80); 

— Increase in the ORM to 43-48 manual control rods; 

— Establishment of the minimum permissible ORM as 30 manual control rods 
(rather than 15 as was the case before the accident); 

— Increase in the number of shortened absorber rods from 21 to 32; 

— Insertion of all RCPS rods (except the shortened ones) by 1.2 m into the core 
(readjustment of the upper limit stop switch); 

— Restriction of the movement of the shortened absorber rods to 3.5 т-1.2 т 
along the deflection angle; 

— Recalculation of the ORM every 5 min rather than every 15 min as was the 
case before the accident; 

— A ban on operation of the four main circulating pumps at reactor power levels 
below 700 MWith) (this confirms that there was no such ban before the 
accident). 


These measures obviously do not tally with the official version, which blamed 
the accident entirely on personnel errors. 


I-3.13. 
The design deficiencies and instability of the physical and thermal-hydraulic 


characteristics of the RBMK-1000 reactor had been theoretically and experimentally 
determined prior to the accident on 26 April 1986. However, no adequate remedial 
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action was taken, firstly, to eliminate the defects and, secondly, to warn the person- 
nel about the consequences of these dangerous characteristics and to provide them 
with appropriate training in the operation of the reactor, the parameters of which did 
not comply with the requirements of the technical standards documentation. The 
designers and authors of the standard operating procedures for the RBMK-1000 reac- 
tor did not inform the personnel about the very real danger of a number of reactor 
characteristics if certain possible personnel actions (including erroneous ones) were 
taken, because they failed to understand the possible cost of the consequences of per- 
sonnel actions in operating such a reactor. The safe operating limits and conditions 
established in the regulations (see section 4 of this report [Section I-4]) were not 
always explicit and intelligible to the personnel, nor were they always analysed. This 
may have affected the operational safety of the reactor, in the design of which certain 
protection functions were shifted from engineered features to the personnel. Further- 
more, no engineering measures were taken by the designers of the reactor to com- 
pensate for the violations of the regulations in the design of the RBMK-1000 reactor. 
One may assume that, although the designers of the reactor knew about the design 
deficiencies and physical characteristics of the reactor, they did not make a quantita- 
tive evaluation of the possible consequences of those deficiencies and did not under- 
stand that they could lead to a disaster. 


In general, having reviewed the design documentation, the Commission feels 
obliged to draw the following conclusions: 


— The design of Chernobyl Unit 4 included major violations of the safety stan- 
dards and regulations in force at the time that the technical design of the second 
stage of the Chernobyl plant (comprising Units 3 and 4) was approved and 
authorized; 


— The designers did not identify, analyse, verify and approve these violations in 
the proper way. No technical and organizational measures were developed to 
compensate for the violations of the safety standards and regulations. Regula- 
tions GSP-73 and NSR-04-74 came into force more than 10 years before the 
accident, during which time Chernobyl Unit 4 was designed, constructed and 
put into operation. During all that time, neither the Chief Design Engineer, nor 
the General Designer, nor the Scientific Manager took effective measures to 
bring the design of the RBMK-1000 reactor into line with the safety standards 
and regulations. The USSR Ministry of Intermediate Sized Machinery, the 
USSR Ministry of Power and the Soviet regulatory authorities were just as lax 
in bringing plants with the RBMK-1000 reactor into line with the safety stan- 
dards and regulations. 


The Commission notes that the design was also not brought into line with the 
General Safety Provisions (GSP-82) which entered into force in 1982. 
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1-4. CAUSES AND CIRCUMSTANCES OF THE ACCIDENT 


I-4.1. General characteristics of the test programme that initiated the accident 
at Chernobyl Unit 4 


The accident at Chernobyl Unit 4 occurred during testing of the capacity of 
turbogenerator No. 8 to supply power during its rundown for the unit's internal 
requirements. 

The tests were necessary because one of the most important emergency operat- 
ing modes had not been properly tested prior to commercial operation of units in this 
series. The proposal to use the rundown mode of the turbogenerator to supply power 
for the unit's internal requirements was made by the Chief Design Engineer [27] in 
order to guarantee forced circulation in the reactor cooling circuit by providing 
reliable electric power supply to the main circulating pumps and feedwater pumps. 
The rundown concept was accepted and included in the design of plants with RBMK 
reactors (see, for example, the Technical Safety Report for the second stage of the 
Smolensk nuclear power plant: ‘‘In a design basis accident, involving total loss of 
power for the unit’s internal requirements, cooling water is fed to the damaged part 
by feedwater pumps powered by the turbogenerator rundown’’). 

According to the design requirements for total loss of power in the event of 
a DBA, electric power supply to the feedwater pumps of the third subsystem of the 
emergency core cooling system (ECCS) had to be provided by the mechanical energy 
of the rundown mode of the turbogenerator. However, Chernobyl Unit 4 was com- 
missioned in December 1983 without having been tested under these conditions. 
Such tests should be an integral part of the pre-operational testing of the main design 
basis conditions carried out at different power levels. 

In 1982, the corresponding tests were carried out at Chernobyl Unit 3 under 
an agreement with the firm Dontekhehnergo with the participation of representatives 
of the General Designer and the S. Ya. Zhuk Gidroproekt Institute. The tests showed 
that the requirements, in terms of the characteristics of the electrical current gener- 
ated by the turbogenerator rundown, could not be met for long enough and that the 
turbogenerator's excitation regulation system had to be improved. 

Additional tests with a modernized rundown unit were performed in 1984 and 
1985. The 1982 and 1984 programmes provided for.the connection of the 
turbogenerator in rundown mode to one main circulating pump on each side of the 
reactor, whereas the 1985 and 1986 programmes provided for connection to two 
main circulating pumps. The 1984, 1985 and 1986 programmes provided for discon- 
nection of the ECCS by manual isolating slide valves. . 

The Commission considers that it is wrong to regard these testing programmes 
as purely electrical ones, since they involve a change in the electricity supply to the 
unit's essential systems and require interference in the protection and blocking 
system. Such tests should be classified as complex unit tests and should be approved 
by the General Designer, the Chief Design Engineer, the Scientific Manager and the 
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regulatory body. However, regulations NSR-04-74 and GSP-82, which were in force 
at the time of the accident, did not require the plant managers to obtain approval for 
such tests from the aforementioned organizations. 

The main idea of the programme is to test the design basis conditions as 
realistically as possible and there is nothing wrong with the programme itself. In the 
light of contemporary approaches to the development of testing programmes for 
conducting similar tests at nuclear power plants, the programme documentation in 
question is not entirely satisfactory, primarily in terms of its safety measures. 
However, the operating documentation as a whole (regulations and instructions), 
together with the programme in question, provided sufficient basis for the safe test- 
ing of the planned operating conditions. The causes of the accident lie not in the 
programme as such, but in the ignorance on the part of the programme developers 
of the characteristics of the behaviour of the RBMK-1000 reactor under the planned 
operating conditions. 

An initial coolant flow rate through the reactor which was higher than the 
nominal rate was a thermal-hydraulic characteristic of the planned mode. Further- 
more, the steam quality was at a minimum for subcooling of the coolant to just below 
boiling point at the core inlet. Both these factors proved to be directly related to the 
scale of effects manifested during the tests. 


I-4.2. Chronology of the events at Chernobyl Unit 4 on 25-26 April 1986 


The Commission based its analysis and conclusions on the following chrono- 
logical sequence of events [Table ГЛ] which it obtained by studying the sources 
indicated in section 4.3 [Section I-4. 3]. 


I-4.3. Information on recorded data used by the Commission 


The Commission analysed the pre-accident and accident processes using data 
recorded by the following instruments and computerized information systems: 


— built-in recording devices with corresponding chart strips; 

— built-in SKALA computerized centralized control system, comprising the diag- 
nostic parameter recording program (DREG) and PRIZMA program for calcu- 
lation of reactor parameters which are not measured directly; 

— special oscilloscope system to record important parameters of the turbogen- 
erator rundown. 


1-4.3.1. Built-in recording instruments 


These instruments are for recording relatively slow processes (the tape speed 
does not exceed 240 mm/h). They therefore make it possible to record peak values 
of the parameters concerned fairly reliably, but cannot be used to record fast non- 
steady processes. 
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TABLE I-I. CHRONOLOGY OF THE CHERNOBYL ACCIDENT 


Time 


25 April 1986 


Event 


(time in operating log) 


01:06 
03:45 


03:47 


from 04:13 
until 12:36 


07:10 
13:05 
14:00 


14:00 


15:20 
18:50 


23:10 


26 April 1986 


Start of reactor power reduction; ORM equals 31 manual control rods 


Start of replacement of the nitrogen—helium gas mixture with 
nitrogen in the gas cooling system for the reactor graphite stack 


Reactor thermal power is 1600 MW 


Sequential measurement of the control system parameters and 
vibration characteristics of turbogenerator No. 7 and turbogenerator 
No. 8 at constant thermal power of 1500 MW 


ORM equals 13.2 manual control rods 
Disconnection of turbogenerator No. 7 from the system 


Disconnection of the ECCS from the multipass forced circulation 
circuit (MFCC) 


Postponement of testing programme requested by Kiev power grid 
controller 


ORM equals 16.8 manual control rods 


Power supply to auxiliary equipment not involved in the tests 
switched to working transformer No. T6 


Power reduction continued, ORM equals 26 manual control rods 


(time on printout of DREG) 


00:05 
(in operating log) 


00:28 
(in operating log) 


Reactor thermal power was 720 MW 


At reactor thermal power of about 500 MW transfer made 

from the local to global niain range automatic power control 
(automatic power controllers Nos 1 and 2). During the transfer 
there was a reduction in thermal power to 30 MW (neutron power 
to zero), which was not envisaged in the testing programme. 
Measures to increase the power were taken 
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TABLE I-I. (cont.) 


Time 


Event 





26 April 1986 (cont.) 
(time on printout of DREG) 


00:34:03 


00:43:37 
00:52:27 
01:00:04 
01:09:45 
01:18:52 
00:36:24 


from 00:39:32 
until 00:43:35 


from 00:41 
until 01:16 
(in operating log) 


from 00:52:35 
until 00:59:54 


01.03 


01:03 
(in operating log) 


01:07 
(in operating log) 


from 01:12:10 
until 01:18:49 


01:19:39 


from 01:19:44 
until 01:19:57 


01:22:30 


01:23:04 
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Emergency fluctuations of water level in steam separator drums 


The EPS trip point in response to a pressure drop in the steam 
separator drums was changed from 55 to 50 kg/cm? 


DREG program did not work 


Personnel blocked the EPS signal which would have shut down the 


two turbogenerators 


Disconnection of turbogenerator No. 8 from the system to determine 


the vibration characteristics during rundown 


DREG program did not work 


Reactor thermal power increased to 200 MW and stabilized 


Seventh main circulating pump was put into operation 
(MCP No. 12) 


Eighth MCP was put into operation (MCP No. 22) 


DREG program did not work 


‘One overcompensation upwards’ signal on 


‘One overcompensation upwards’ signal on 


The parameters were recorded on magnetic tape (calculations 
were performed at the Smolensk plant after the accident using 
the PRIZMA program; ORM proved to be equal to 8 manual 
control rods) 


‘Oscilloscope is on’ signal was given, emergency stop valves 
of turbogenerator No. 8 were closed. The rundown was started 
of four MCPs: MCPs Nos 13 and 23 (section 8RA) and MCPs 
Nos 14 and 24 (section 8RB) 


TABLE LI. (cont.) 


Time 


Event 


26 April 1986 (cont.) 
(time on printout of DREG) 


01:23:10 
01:23:30 


01:23:40 
(01:23:39 
on teletape) 


01:23:43 


01:23:46 
01:23:46.5 
01:23:47 


01:23:48 


01:23:49 


Design basis accident button was pressed 


*One overcompensation upwards' signal went off (it lasted 
3 min 33 s) 


ЕР$-5 button was pressed; the EPS rods and manual control 
rods started to move down into the core 


Power excursion rate emergency protection system signals on; 
excursion period: less than 20 s; emergency power protection 
system signals actuated; power exceeded 530 MW(th) 


Disconnection of the first pair of MCPs being 'run down' 
Disconnection of the second pair of MCPs being 'run down' 


Sharp reduction in the flow rates (by 40%) of MCPs not involved 
in the rundown test (MCPs Nos 11, 12, 21 and 22) and unreliable 
flow rate readings of the MCPs taking part in the rundown 
(MCPs Nos 13, 14, 23 and 24); sharp increase of pressure in the 
steam separator drums; sharp increase in the water level in the 
steam separator drums; signals ‘failures of measuring systems’ 
from both main range automatic controllers (automatic power 
controllers Nos 1 and 2) 


Restoration of flow rates of MCPs not involved in the rundown test 
to values close to the initial ones; restoration of flow rates to 15% 
below the initial rate for the MCPs on the left side which were being 
‘run down’; restoration of flow rates to 10% below the initial rate for 
MCP No. 24; unreliable readings for MCP No. 23; further increase 
of pressure in the steam separator drums (left side 75.2 kg/cm’, 


‚ right side 88.2 kg/cm?) and of water level in the steam separator 


drums; triggering of fast acting systems for dumping of steam to 
condensers Nos 1 and 2 


Emergency protection signal ‘Pressure increase in reactor space . 
(rupture of a fuel channel)’; ‘No voltage = 48 У’ signal (no power. 
supply to the servodrive mechanisms of the EPS); ‘Failure of the 
actuators of automatic power controllers Nos 1 and 2” signals 


From а note in the chief reactor control engineer’s operating log: 
“01:24: Severe shocks; the RCPS rods stopped moving before they 
reached the lower limit stop switches; power switch of clutch 
mechanisms is off” 
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1-4.3.2. SKALA centralized control system and subsystems 


The system was designed to calculate the basic reactor parameters every 
5 min, this period being determined by the power of the V-3M type computer. This 
period is also unsuitable for analysing fast processes. 

The DREG program is very comprehensive and has a good time resolution. 
It samples and records several hundred discrete and analogue signals. The time of 
input into the computer of information on directly measured parameters is less than 
1 s. However, the DREG program does not record important reactor parameters, 
such as power, reactivity and channel coolant flow rates. It records the position of 
only nine of the 211 RCPS rods, including one rod from each of the three automatic 
control groups. These parameters are not measured directly and therefore the sam- 
pling interval is much longer (1 min). Notwithstanding the short recording time of 
some parameters (1 s), the sampling time may be rather uncertain because the DREG 
program has one of the lowest priorities in the SKALA centralized control system. 
In addition, during the last hour before the accident there were three interruptions 
in the operation of the DREG program, associated with restarting of the SKALA 
system. These caused an additional loss of information. Other subsystems of the 
SKALA system, including the PRIZMA program and magnetic tape records of reac- 
tor conditions (RESTART) have a long cycle (5 min). There were also interruptions 
in these systems caused by restarting of the system and the software characteristics. 
Furthermore, the results of the PRIZMA program are recorded only on printouts. 


1-4.3.3. Oscilloscope system 


A special oscilloscope system for fast changing parameters was installed in 
accordance with the testing programme. 

This made it possible to obtain performance parameters of certain equipment 
items with a good degree of accuracy: turbogenerator No. 8, MCP No. 18, feed- 
water pump No. 4, sections 8RA and 8RB. One shortcoming of this system is the 
lack of synchronization between the electrical parameters and the reactor parameters 
recorded by the SKALA system. However, the documents available — the results 
of processing the electrical parameter oscillograms and recordings of the DREG 
program — make it possible to synchronize the reference events fairly accurately. 
The main events were the closure of the turbogenerator No. 8 stop valves and the 
time at which the EPS-5 button was pressed by the operator. 

According to the DREG records, the time at which the stop valves of turbo- 
generator No. 8 closed was 01:23:04. This time may be determined by the change 
in certain parameters on the oscillogram. The signal to actuate emergency protection 
system No. 5 occurred at 01:23:40, as can also be seen from the oscillogram. 
Changes in the electrical parameters are recorded on the oscillogram with a high 
degree of accuracy, and it is therefore possible to determine the times at which the 
DBA button was pressed and the MCPs were disconnected. The first pair of MCPs 
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being run down was disconnected at 01:22:46, and the supply to the second pair of 
MCPs was cut 0.45 s later. This means that these events occurred 6.00 s to 6.45 $ 
after the EPS-5 button was pressed by the operator. 

An analysis of the oscillogram shows that the DBA button was pressed 6.6 s 
after closure of the turbogenerator No. 8 stop valves. 


Note: The DBA button is a button specially installed for test purposes in order 
to simulate a DBA signal, to transmit it to the startup system of diesel generator 
No. 6 with a step by step load increase circuit, and to connect the turbo- 
generator No. 8 rundown unit being tested. 


I-4.4. Mathematical modelling of the pre-accident and accident processes 


The Commission notes that, however comprehensive and reliable the informa- 
tion on reactor parameters recorded by the instruments in an accident situation is, 
mathematical modelling of the pre-accident and accident processes is needed in order 
to analyse this type of accident. It is necessary not only in order to fill the gaps in 
the recorded information and to make extrapolations in the area of the parameters 
that were not measured, but also in order to clarify the sensitivity of the results in 
the case of certain very important initial parameters. Without this, it is also impos- 
sible to judge the adequacy of the subsequent measures to prevent future accidents. 

Having analysed the available information, the Commission is of the opinion 
that no complex mathematical model has yet been developed which is properly suited 
to the RBMK-1000 reactor and which has been checked against experimental 
data. The Scientific Research and Design Institute for Power Technology, the 
I.V. Kurchatov Institute of Atomic Energy, the All-Union Scientific Research Insti- 
tute for Nuclear Power Plant Operation, the Kiev Institute of Nuclear Research and 
certain other organizations have: various models covering the different phenomena 
necessary for the analysis. There are also mathematical models in some foreign 
organizations and the results of calculations using these models have been discussed 
with Soviet experts. 

By compiling the calculation results of the various fragments of the pre- 
accident and accident processes which do not contradict each other and which agree 
with the experimental data available, it now appears that a fairly realistic picture of 
the accident can be obtained. 

One of the first calculational studies after the accident was performed at the 
I.V. Kurchatov Institute of Atomic Energy using a one dimensional model [3] in 
which the dependence of reactivity on the position of the RCPS rods was derived 
from a spatial model. However, despite a generally satisfactory description of the 
major events starting at 01:19, it is a rough model, since it does not provide a 
detailed description of the process in the core and consequently cannot give reliable 
results on the behaviour of the reactivity, power and other parameters. This is con- 
firmed by the fact that there are discrepancies between the calculations and the 
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recorded data (the absence in reality of a ‘1 Overcompensation — downwards’ signal 
at 01:23:38, the underestimated value for the flow rate through the MFCC at 
01:23:43, etc.), as well as by the lack of correspondence between the behaviour of 
the reactivity parameter and that of the power parameter. 


A version of the distributed high speed neutron physics RBMK model was 
developed and used in calculational studies of the accident at the Kiev Institute of 
Nuclear Research. It describes the neutron transport using a non-stationary one- 
group diffusion equation which is solved on a large grid with 50 cm spacing. The 
coolant density and the movement of the RCPS rods are taken into account by adjust- 
ment of the constants, and the change in temperature is introduced as feedback via 
the temperature coefficient of reactivity. The results of prognostic calculations 
(REFUELER) are used to represent the axial distribution of fuel assembly burnup. 
The one-group constants are drawn from the two-group ones calculated by the WIMS 
program. This model was used in the DIKRUS software package developed at the 
All-Union Scientific Research Institute for Nuclear Power Plant Operation as a high 
speed neutron physics calculation code [28]. The code was used to study the drop 
mode of the EPS-5 rods for the reactor conditions at Chernobyl Unit 4 on 26 April 
1986 at 01:22:30. 


The combination of a satisfactory description of the power density kinetics and 
satisfactory thermal-hydraulic description of the thermal inertia of the fuel elements 
and of the steam generation growth in the core, together with the preliminary pains- 
taking adjustment of the model using the distributed initial data, makes this one of 
the best models currently available for analysis of the Chernobyl accident. 


The results of the simulation of the process do not contradict the data recorded 
by the DREG program during the last 9 s (the signals of the power increase rate pro- 
tection and power protection systems, the increase of pressure and water levels in 
the steam separator drums and the pressure increase in the reactor space 3, 6 and 
9 s after pressing of the EPS-5 button). 


However, this model still cannot be regarded as suitable enough for the RBMK 
reactor, since the one-group approximation in the non-stationary equation on a 
coarse difference grid probably does not yield the necessary accuracy for this type 
of reactor. Furthermore, the data taken as initial data were those (on the location of 
the RCPS rods, currents of the sensors of the physical power density distribution 
control system, etc.) recorded 1 min 10 $ before the start of the conditions being 
studied. It was about this time that intensive feeding of the steam separator drums 
stopped, and 34 s later the turbine stop valves were closed. Thus, by the time that 
the EPS-5 button was pressed at 01:23:40 the parameters might have changed. 
Nevertheless, the Commission considers that the results of this study are among the 
most comprehensive ones so far, that they do not contain any major unrealistic 
assumptions and do not contradict the results of other fragmentary studies. They 
therefore have a good claim to be taken as a basis for the analysis of the processes 
that occurred. 
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The STEPAN computer code developed at the I.V. Kurchatov Institute of 
Atomic Energy [29] may be considered to be the most advanced of the Soviet neutron 
physics models of the RBMK reactor. 

It is used to solve non-stationary two-group diffusion equations of neutron 
transport in a three dimensional geometry taking 18 groups of delayed neutrons into 
account (6 groups each for 2350, 239Ри and 2“Ри). The two-group diffusion con- 
stants of the RBMK operating cells are presented as a function of five variables: fuel 
burnup, coolant density, fuel and graphite temperatures and xenon concentration. 
The initial values of the constants are calculated by the WIMS code. 

The Commission notes that no detailed analysis of the origins and development 
of the accident using the STEPAN code as a neutron physics component of the 
mathematical model has been made in which the effects of all the factors are consid- 
ered (critical ORM values, coolant subcooling at the core inlet, etc.). 

In addition to the aforementioned characteristics and shortcomings of the 
different calculation models, there are difficulties caused by incorrect initial data in 
applying even the most advanced of them. This is because there are no calculations 
of the axial isotope composition (power density) distribution in the working channels 
of the built-in centralized control system. The distribution is therefore calculated as 
a function of the total fuel assembly power density, without taking account of the 
specific operating conditions of the fuel assemblies. This means that the transient dis- 
tribution of Xe immediately before the onset of the accident process cannot be 
correctly taken into account. The effect of these factors on the distributed models 
may well be significant. Hence, the accuracy in determining the parameters of the 
reactor state (neutron fluxes, power, reactivity, temperature, etc.), the times of 
events (attainment of maximum reactivity or prompt criticality, temperature limits, 
etc.) and co-ordinates (maximum neutron flux, power density, fuel damage, etc.) is 
reduced. : 

It is the Commission's view that the work on improving mathematical simula- 
tion techniques for the RBMK reactor, on verifying them and performing calcula- 
tional analyses of the Chernobyl accident is being carried out extremely slowly and 
is regarded as a low priority. As a result, no sufficiently representative quantitative 
analysis has yet been conducted that takes full advantage of the possibilities of con- 
temporary computer technology and developments in RBMK reactor physics. 


1-4.5. Scenarios and possible causes of the accident 


The first official version of the accident was formulated on 5 May 1986 at the 
Chernobyl plant by the Interdepartmental Commission under the Chairmanship of 
the First Deputy Minister of Intermediate Sized Machinery, А.С. Meshkov [30]. It 
stated that the accident at Chernobyl Unit 4 was caused by an uncontrolled reactor 
runaway as a result of steaming of the fuel channels in the core following a break 
in circulation in the MFCC. The break in circulation resulted from a mismatch 
between the flow rates of feedwater and coolant in the MFCC. 
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Somewhat earlier, оп | Мау 1986, V.P. Volkov, head of the I.V. Kurchatov 
Institute Research Group on the Reliability and Safety of Nuclear Power Plants with 
RBMK Reactors, provided A.P. Alexandrov, Director of the I.V. Kurchatov Insti- 
tute of Atomic Energy, and subsequently the leaders of the country, in a letter of 
9 Мау 1986, with another version of the accident which attributed it “пої to the 
actions of the operating personnel, but to the design of the reactor core and a lack 
of proper understanding of the neutron physics processes going on in it.’’ This 
version suggested that the accident was caused by a positive reactivity excursion 
following the insertion of the RCPS rods as a result of their defective design and the 
large positive void coefficient of reactivity. 

A subsequent, more detailed, analysis of the thermal-hydraulic operating mode 
of the MCPs made at the end of May 1986 by the Mechanical Engineering 
Experimental Design Office (designers of the MCPs), the S.Ya. Zhuk Gidroproekt 
Institute and the F.E. Dzerzhinskij All-Union Heat Engineering Institute did not 
confirm the theory about cavitation and disruption in the circulation of the MCPs 
[31]. It was established that the lowest MCP cavitation margin occurred at 01:23:00, 
i.e. approximately 40 s prior to the runaway of the reactor, but that it was higher 
than that at which a disruption in circulation of the MCPs could take place. 

At the end of May 1986, after having analysed the available data and per- 
formed various calculations, a group of experts of the USSR Ministry of Power 
(A.A. Abagyan, Yu.N. Filimontsev, V.S. Konviz, V.Z. Kuklin, B. Ya. Prushinskij, 
G.A. Shasharin, A.S. Surba and V.A. Zhil’tsov) sent an addendum to the Report 
on the Investigation of the Accident [32], in which they attributed the causes of the 
accident to the fundamentally faulty design of the RCPS rods; the positive void and 
fast power coefficients of reactivity; the large coolant flow rate in conjunction with 
a low feedwater flow rate; violation of the ORM limit by the personnel, with conse- 
quent low power level; inadequate safety features in the design and inadequate oper- 
ating information for the personnel; and lack of indications in the design 
documentation and the technical regulations on the danger of ORM violations. 

At two meetings of the Interdepartmental Science and Technology Council, 
chaired by A.P. Aleksandrov (2 June 1986 and 17 June 1986), insufficient attention 
was paid to the calculations made by the All-Union Scientific Research Institute for 
Nuclear Power Plant Operation which demonstrated that the accident was largely due 
to deficiencies in the reactor design. In fact, all the causes of the accident were 
reduced exclusively to personnel errors. The decisions taken by the Interdepartment 
Science and Technology Council paved the way for the one-sided presentation of 
information on the causes and circumstances of the accident submitted to the IAEA, 
a wide range of specialists and the general public. 

No mention was made in the report presented by the USSR at the meeting of 
IAEA experts in Vienna in August 1986 [33] of the version suggesting a disruption 
in circulation of the MCPs. That report states that: ‘‘the prime cause of the accident 
was an extremely improbable combination of violations of instructions and operating 
rules committed by the staff of the unit.” The event initiating the accident was not 
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mentioned. However, the main events of the accident process were presented in the 
following way” (see Ref. [33], р. 309). 


**By the beginning of the tests, namely at 01:23, the reactor parameters were 
closer to being stable that at any other time. Closure of the turbine emergency 
stop valve resulted in a slow increase in steam pressure in the steam separator 
drums at a rate of about 6 kPa/s. At the same time, the coolant flow rate began 
to fall owing to the fact that four of the eight MCPs were in ‘rundown’ mode. 
A minute earlier (at 01:20) an operator reduced the feedwater flow rate.” 


Note by the Commission: In fact, the feedwater flow rate was brought back 
to the average value corresponding to a reactor power of 200 MW and equal 
to about 120 t/h for each side of the reactor. 


“Тһе reduction in flow rate of coolant through the reactor and of feedwater 
in the steam separator drums, despite the competing effect (in terms of steam 
generation) of the pressure increase, finally resulted in an increase in reactor 
power, since there is a positive feedback in the reactor between power and 
steam generation. Under the test conditions, the steam quality in the core was 
negligible before the start of the turbogenerator rundown, and it increased 
much more than during normal operation at rated power” ([33], p. 309). 


‘*The increase in power might have prompted the personnel to press the EPS-5 
button. Since, in violation of the Operating Procedures, the personnel had 
withdrawn more than the permissible number of manual control rods from the 
core, the EPS rods were not effective enough and the total positive reactivity 
continued to grow” ([33], p. 311). 


As can be seen from the foregoing official version, the closure of the turbine 
emergency stop valve was the event which initiated the accident, in other words the 
beginning of the rundown test, exacerbated by the reduction in the feedwater flow 
rate. 

The Commission notes that the official scenario contains no supporting calcula- 
tions and no additional data. In particular, in the study carried out by experts in the 
United States of America [34] on the basis of information presented by Soviet 
specialists to the IAEA, it is shown that the calculations do not confirm the conclu- 
sion on the change in power and the explosion during the tests. The same conclusion 
is contained in the report by the Scientific Research Institute for Power Technology 
[17] issued in 1990 and in the paper by its Director, E.O. Adamov [35]. 

In 1986, the I. V. Kurchatov Institute of Atomic Energy analysed possible acci- 
dent scenarios which could have involved a rapid significant increase in reactivity 
in the reactor [3]. 


The aim of the analysis was to identify the contradictions between the expected 
effect of the accident scenario being considered and the available objective data 
recorded by the DREG program. 
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There are 13 such scenarios which have been proposed by different experts at 
different stages of the investigation into the accident: 


(1) Hydrogen explosion іп a steam separator drum; 

(2) Hydrogen explosion in lower tank of the RCPS cooling circuit; 

(3) Sabotage (explosion of an explosive device resulting in destruction of MFCC 
piping); 

(4) Rupture of MCP pressure header or of the distribution group header; 

(5) Ruptures of steam separator drum or steam-water lines; 

(6) Effect of RCPS rod displacers; 

(7) Failure of automatic controller; 

(8) Serious operator error in controlling the manual control rods; 

(9) MCP cavitation leading to a steam-water mixture supply to fuel channel; 

(10) Cavitation of the throttle regulating valves; 

(11) Steam capture from steam separator drum to downcomers; 

(12) Steam-zirconium reaction and hydrogen explosion in the core; 

(13) Penetration of compressed gas from the cylinders of the ECCS. 


The study by the I. V. Kurchatov Institute of Atomic Energy shows that all the 
aforementioned scenarios except one (No. 6) contradict the objective data available. 

With reference to this analysis, the Commission notes that, according to the 
calculations of the All-Union Scientific Research Institute for Nuclear Power Plant 
Operation [28], given the initial state of the reactor just before the tests and the inher- 
ent large positive void coefficient of reactivity of the reactor, a major coolant leakage 
(with a diameter of more than 300 mm) from the MFCC could have resulted in an 
accident which would have been just as serious. For some time during the investiga- 
tion of the accident, it was in fact assumed that the MFCC had been damaged, as 
a result, for example, of increased vibration of the MCPs caused by their possible 
cavitation. However, the coolant leakage scenarios (see Nos 3, 4 and 5 in the list) 
were discarded because in those cases the readings of the instruments indicating the 
pressure and water levels in the steam separator drums and a number of other 
parameters would have been different. Furthermore, examinations of the MFCC 
buildings of Chernobyl Unit 4 carried out during the years following the accident did 
not reveal any damage to the circuit which could have been the initiating event for 
the accident. 

In view of the foregoing, the Commission thinks that a thorough study should 
be made of the accident scenario concerning the reactivity effect of the RCPS rod 
displacers, caused by their design, together with the whole sequence of technical 
operations during the turbogenerator rundown tests, taking the physical characteris- 
tics of the RBMK-1000 reactor into account. No assumptions about improbable 
events are needed for this scenario. 

In a letter of 26 March 1990 signed by the Deputy Director of the 
I. V. Kurchatov Institute of Atomic Energy, N.N. Ponomarev-Stepnoj, the Director 
of the Scientific Research and Design Institute for Power Technology, 
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Е.О. Adamov, and the Director of the All-Union Scientific Research Institute for 
Nuclear Power Plant Operation, A.A. Abagyan, this scenario was not rejected, as 
can be seen from the following wording: 


**The accident occurred as a result of bringing the reactor to a state which did 
not conform to the operating regulations. There were several reasons for this, 
the main ones being: the reduction in the operational reactivity margin to below 
the value established in the Operating Procedures and the fact that the coolant 
was only slightly subcooled at the core inlet. These conditions led to the 
manifestation of the positive void coefficient of reactivity, deficiencies in the 
design of the RCPS rods, and an unstable neutron field profile as a result of 
a complex transient. The accident ended with a prompt neutron runaway 
reaction’’ [36]. 


No mention is made in the foregoing extract of any external thermal perturba- 
tions which might have indicated the major negative effect of the positive void coeffi- 
cient of reactivity, on the existence of which the Scientific Research and Design 
Institute for Power Technology insists [17]. Additional work on this obvious 
unresolved contradiction must be carried out if we are to clarify the causes of the 
accident. 

The Commission does not have a mathematical model describing the course of 
the accident. However, on the basis of the instrumental measurements made at the 
damaged unit and the fragmentary calculations carried out and published by other 
organizations, it considers that it is possible and useful to present the following 
scenario of the pre-accident and accident processes, together with evaluations of the 
personnel actions and the effect of the reactor characteristics. 


I-4.6. The Commission’s scenario on the causes of the accident 
1-4.6.1. Period of normal operation and preparations for the tests 


The initial reduction of the power of the unit which was commenced at 01:06 
on 25 April 1986 and the continued reduction below 720 MW(th) after 00:00 on 
26 April did not play an initiating role in the accident, although two violations of 
the Operating Procedures occurred during that time: reactor operation with an ORM 
below the permissible value and disconnection of the ECCS. 

After 00:28 on 26 April a most important safety significant event occurred. In 
transferring from the local automatic control system for the core distribution of the 
power density to the global automatic power regulator, the senior reactor control 
engineer failed to eliminate fast enough the imbalance that appeared in the measuring 
part of the global automatic power regulator and allowed the thermal power of the 
reactor to fall from 500 MW to 0-30 MW (approximately). 

Following the unsuccessful attempts to control the reactor, it proved necessary 
for some of the ORM rods to be withdrawn in order to compensate for the additional 
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negative reactivity caused by xenon poisoning of the core at low power and during 
the subsequent power rise to 200 MW. In doing this, the Commission believes that 
the personnel brought the reactor into a state which did not comply with the operating 
regulations and in which the emergency protection system could no longer guarantee 
the termination of the nuclear reaction (see section 4.8 of this report [Section 1-4. 8]). 
It is not clear whether or not the personnel realized the serious consequences of their 
actions. 

During the period from the beginning of power rise to stabilization of the 
reactor parameters at 200 MW at about 01:23, normal technical processes and opera- 
tions were taking place at the unit (except for the switching on of the fourth MCP 
pair). These included triggering of the fast acting system for dumping steam to the 
condenser, manual control of the water level in the steam separator drums, over- 
compensation of the reactor, etc. 

At 01:22:30 the reactor parameters were recorded on magnetic tape by the 
SKALA centralized control system. No operating calculations were performed by 
the PRIZMA program at this time. These calculations were made after the accident 
using the magnetic tape from the centralized control system and the PRIZMA- 
ANALOG code at the Smolensk nuclear power plant. The control room personnel 
and the SKALA system personnel did not have the operating calculation results and 
did not know the calculated parameters, including the ORM, at this time. 

As part of the evaluation of the causes and scale of the accident, the Commis- 
sion notes the following characteristics of the operating conditions at this time. 

There was a double peaked axial power density distribution over most of the 
core, the neutron flux being higher in the upper part of the core [20]. This was a 
perfectly normal distribution for the particular state of the reactor at that time: 
partially burnt up core, almost all contro] rods in the upper position and xenon 
poisoning higher in the central parts than at the edge of the core [1, 33]. As calcula- 
tions have shown [32, 37], this distribution was a very unfavourable one in terms 
of kinetic stability in combination with the design of the RCPS. 

The thermal-hydraulic operating conditions of the core were characterized by 
a low level of subcooling of the coolant below the boiling temperature (3°C) and a 
correspondingly low steam quality, which was observed only in the upper part of the 
core [28]. Under these circumstances, in view of the low level of subcooling of the 
coolant below the boiling temperature, a small power increase (for whatever reason) 
could result in a much higher increase in the volumetric steam quality in the lower 
part of the core than in the upper part. 

Before the tests, the core parameters were therefore such as to increase the 
reactor’s runaway susceptibility in the lower part of the core. The Commission 
believes that this situation was created not only as a result of a higher than normal 
flow rate of coolant through the reactor (because eight instead of the usual six MCPs 
were in operation, and an increased flow rate prevents steam generation), but primar- 
ily as a result of the low reactor power level. Similar thermal-hydraulic parameters 
could occur during any power reduction of the reactor. 


64 


The unit’s initial condition immediately before the tests at 01:23 was character- 
ized by the following parameters: power of 200 MW(th), ORM (value obtained using 
the PRIZMA-ANALOG code for the state at 01:22:30) equal to 8 manual control 
rods, double peaked axial neutron field with a maximum above, coolant flow rate 
of 56 000 m?/h, feedwater flow rate of 200 ИВ and thermophysical parameters close 
to stable values. 

The unit shift supervisors considered that preparations for the tests had been 
completed and, having switched on the oscilloscope, gave the order to close the 
emergency stop valves. These were closed at 01:23:04. 

At this time, and for the following approximately 30 s of rundown of the four 
MCPs, the parameters of the unit were controlled, remained within the limits 
expected for the operating conditions concerned, and did not require any intervention 
on the part of the personnel. 

However, it would appear that, under the conditions of reduced ORM, as of 
00:30 on 26 April 1986 it would have been impossible to use the emergency protec- 
tion system of the reactor of this particular design, either in response to emergency 
signals or manually after completion of the tests, without damaging the core. This 
will have to be confirmed by further studies. 


1-4.6.2. Implementation of the test programme 


The tests, which started at 01:23:04, caused the following processes in the 
reactor. 

The rotational speed and delivery of the MCPs powered from turbogenerator 
No. 8, which was being run down (MCPs Nos 13, 14, 23 and 24), were reduced. 
Delivery of the other MCPs (MCPs Nos 11, 12, 21 and 22) was slightly increased. 
The total coolant flow rate began to fall. Thirty-five seconds after the start of the 
transient it had fallen by 10-15% of the initial value. 

The reduction in coolant flow rate led to a corresponding increase in steam 
quality in the core, which was to some (small) extent offset by the increase in pres- 
sure following the closure of the emergency stop valves of turbogenerator No. 8. 

This stage of the process has been mathematically modelled by experts in the 
USSR [32] and in the USA [34]. The theoretical predictions of the integral 
parameters agree well with the values actually recorded. Both calculations showed 
that the released void reactivity was negligible and could have been compensated for 
by insertion for a short distance (up to 1.4 m) of the EPS rods into the core. 

During the rundown of turbogenerator No. 8 there was no increase in reactor 
power. This is confirmed by the DREG program, which from 01:19:39 until 
01:19:44 and from 01:19:57 until 01:23:30 (i.e. prior to and for a substantial period 
during the tests) recorded the ‘One overcompensation upwards’ signal, at which time 
the automatic control rods could not move into the core. Their positions, recorded 
for the last time at 01:22:37, were 1.4, 1.6 and 0.2 m for automatic regulators 
Nos 1, 2 and 3 respectively. 
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` Thus, neither the reactor power пог the other parameters (pressure and water 
level in the steam separator drums, coolant and feedwater flow rates, etc.) required 
any intervention by the personnel or by the engineered safety features from the 
beginning of the tests until the EPS-5 button was pressed. 
The Commission did not detect any events or dynamic processes, such as 
hidden reactor runaway, which could have been the event which initiated the acci- 
dent. The Commission identified a rather extended initial reactor state, during 
which, if positive reactivity had occurred for any reason, there could have been a 
power excursion under conditions in which the reactor's EPS would be unable to per- 
form its functions. 


1-4.6.3. Development of the accident 


At 01:23:40 the senior reactor control engineer pressed the manual emergency 
stop button (EPS-5). 

The Commission was unable to establish why the button was pressed. 

Since the rate of development of subsequent events is not compatible with the 
resolving power of the reactor parameter recording devices, further analysis is only 
possible using theoretical concepts based on the instrument readings with the 
necessary time corrections which have to be made because of the characteristics 
of the recording system (information on which is given in section 4.3 of this report 
[Section 1-4. 3]). 

Reconstruction of the power density field by means of physical calculations 
[28] has confirmed the axial distribution with an acceptable degree of accuracy and 
demonstrated that there was also considerable lack of uniformity in the radial power 
density distribution (power peaking factor of 2.0). Thus, the initial power density 
distribution over the whole core was extremely non-uniform [20, 28]. 

There is very satisfactory agreement between the various mathematical models 
of the power density kinetics performed independently by different organizations 
(21, 35]. No results have been found which contradict the foregoing conclusions. 
This enables us to interpret what had happened in the following way. 

The movement of the EPS and manual control rods in response to the EPS-5 
command caused significant additional deformations of the power density profile. 
The neutron flux began to decrease in the upper layers of the core where insertion 
of the absorber parts of the EPS and manual control rods started. In the lower 
sections of the core where displacement of the neutron absorbing water columns 
started, the neutron flux increased. 

The reactor power recorder, which displays the total current of the lateral ioni- 
zation chambers located outside the core, recorded a small decrease in power and 
a subsequent increase. The calculations in Refs [21] and [35] both show that during 
the subsequent period practically all of the power density shifted to the lower part 
of the core at a height of about 2 m. Both calculations show that the linear heat flux 
in the lower parts of the fuel elements increased repeatedly at different rates in differ- 
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ent parts of the core cross-section. The calculations show that the local growth in 
power density, after the EPS-5 button had been pressed, was such that the integral 
reactor power increased in comparison with the initial value several tens of times 
during a period of about 5 $. The calculations in Refs [17] and [20] show the appear- 
ance of all lateral ionization chamber signals only 3 s after pressing of the EPS-5 
button. No information on these signals is provided in the calculations in Ref. [28], 
possibly owing to a lack of interest in this parameter. 

The total lack of black absorbers (only one additional absorber) in the core, 
and the presence of saddle points in the power density profile in many parts of the 
core, which cause kinetic instability of the axial field, particularly in the event of the 
introduction of negative reactivity in one part and of positive reactivity in the other, 
produced strong power density deformations in the reactor volume [17, 20, 28]. 

From the foregoing results, it follows that, under the initial neutron field condi- 
tions, once the movement of the EPS and manual control rods had started, it was 
bound to cause strong power density deformations in the core with extremely high 
non-uniformity parameters. 

According to the calculations in Ref. [28], the volumetric peaking factor was 
К, = 5.5. Taking into account the fact that the initial power in the core increased 
by about 30 times (according to the same calculations), the linear heat flux in the 
regions of greatest intensity were many times higher than the nominal values at 100% 
reactor power. Therefore, the fuel element enthalpy reached critical values in some 
of the fuel channels in the lower part of the core, resulting in different degrees of 
damage to the fuel elements. 

As is shown in the study performed by Japanese experts [35] based on direct 
experimental research, the fuel elements begin to disintegrate at an enthalpy of 
220 cal/g UO, (T = 3300 К) [J cal = 4.184 Л. At an enthalpy of 285 cal/g UO;, 
the fuel elements rupture, and at 320 cal/g ОО, they explode and disperse in small 
pieces. 


Note: The RBMK reactor fuel elements are not entirely identical with the fuel 
elements used by the Japanese scientists in their experiments. However, the 
Commission believes that although there may be quantitative discrepancies 
between the critical enthalpies of the model and the real fuel elements, these 
do not alter the basic conclusion about the disastrous disintegration mechan- 
ism, which is also referred to in Refs [1] and [38]. 


The results of the calculation studies performed four years after the accident 
by leading organizations in the area of reactor physics, such as the Scientific 
Research and Design Institute for Power Technology, the All-Union Scientific 
Research Institute for Nuclear Power Plant Operation, the I. V. Kurchatov Institute 
of Atomic Energy and the Kiev Institute of Nuclear Research [17, 28], have demon- 
strated the possibility that insertion of the EPS rods into the reactor may cause a 
dangerous increase in power of the RBMK-1000 reactor and a multiple increase in 
local power densities in the core. 
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As can be seen from the foregoing, the event which initiated the accident was 


the pressing of the EPS-5 button when the RBMK-1000 reactor was operating at low 
power with a greater than permissible number of manual control rods withdrawn 
from the reactor. 
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Note: 


Since, as far as the Commission is aware, the possibility of the accident 
scenario presented here is not currently disputed by any organization and, 
moreover, it fully corresponds to the accident sequence formulated by the 
directors of three leading institutes — the I.V. Kurchatov Institute of Atomic 
Energy, the Scientific Research and Design Institute for Power Technology 
and the All-Union Scientific Research Institute for Nuclear Power Plant Opera- 
tion [36] — we think that in order to conclude the analysis, we can present a 
scenario of the subsequent events which is no longer based on calculations. 


Using the data in Ref. [35] relating to the destructive forces of the disastrous 
process and the data presented in section 3 of this report [Section [-3] on the 
design and characteristics of the reactor, the scenario of the accident process 
may be described in the following way. 


Ruptures and destruction of certain parts of the fuel elements in a limited zone 
of the reactor caused by large local heat releases led to increased steam genera- 
tion owing to the direct contact of water with the fuel matrix, and to increased 
pressure in the corresponding parts of the fuel channels and their destruction 
as a result of the direct contact of the fuel with the channel tube and local 
increase in pressure [35]. 


During the initial phase of the reactor runaway, the specific neutron field con- 
figuration with saddle points in the middle sections of the core (this is an objec- 
tive and unavoidable factor for many reactor states [32]), and the presence of 
more than the permitted number of water columns in the lower parts of the core 
(which occurs rarely, is subjective and permitted by personnel) were decisive 
factors. Once a certain thermal inertia of the fuel elements in the region of 
highest power densities had been overcome, steam generation began, which, 
owing to the large local void coefficient of reactivity, made a significant contri- 
bution to the non-uniform runaway of the core and rapid fuel damage in the 
regions of greatest power intensity. 


After the initial phase of neutron flux redistribution, caused by the design of 
the RCPS rods and independent of the thermal-hydraulic state of the reactor 
and the MFCC, the increase in power density caused the large void reactivity 
effect inherent in the RBMK-1000 reactor design. With the appearance and 
growth of steam generation, the zone of increased power density began to 
expand out of control over the whole core. 


Substantial confirmation of the local nature of the initial stage of the runaway 
is provided by the non-uniform growth in pressure in the left and right steam 
separator drums. The rapid change in many of the general parameters (signals 
of the power increase rate protection system and power protection system, 
increase in pressure, signal indicating an increase in pressure in the reactor 
space) demonstrates the rapid transition of the local runaway into a general 
one. 


Owing to the design characteristics of the reactor, substantial damage to even 
a few fuel assemblies (three or four assemblies are enough) can, and in this 
case did, result in destruction of the reactor itself and failure of its emergency 
protection system. The rupture of the pipes of several fuel channels caused an 
increase in pressure in the reactor space and a partial detachment of the reactor 
support plate from the shroud and consequent jamming of all the RCPS rods, 
which by that time were only half-way down. 


The destruction of fuel channel pipes, initiated at first by only a local neutron 
power surge, intensified by steam generation in a limited zone of the reactor, 
caused a new effect from the time at which the channel pipes started to rupture, 
namely mass generation of steam over the whole core as a result of depressuri- 
zation of the reactor cooling circuit and release of the large total void reactivity 
effect inherent in the reactor. However, no DBA signal to bring the ECCS into 
operation, once depressurization of the MFCC started, was given because the 
point at which the MFCC ruptured was not in the reinforced leaktight compart- 
ments where the sensors are placed, but in the core itself. 


Subsequently, intense steam generation in the reactor space played a significant 
role. 


The Commission notes that there are studies which contain enough information 
to clarify the physical processes which occurred in the core during the initial stage 
of the accident process. These studies were carried out by experts of the All-Union 
Scientific Research Institute for Nuclear Power Plant Operation, the Kiev Institute 
of Nuclear Research and the I. V. Kurchatov Institute of Atomic Energy [28] and the 
Scientific Research and Design Institute for Power Technology [17]. Both papers 
study the physical processes in the core during the movement of the RCPS rods into 
the core in response to the EPS-5 command, without reference to external thermal 
effects such as cavitation of MCPs, depressurization of the MFCC and so on. 

As was stated earlier, both calculations are in a good agreement and indicate 
a shift in the power density field to the lower part of the core and a substantial 
increase in its overall non-uniformity. However, the conclusions of the calculations 
contradict each other in their explanation of the causes of the accident. The calcula- 
tions in Ref. [28] attribute the cause of the accident to a local power excursion, 
whereas the calculations in Ref. [17], although they confirm these effects, conclude 
that the quantitative values of local power density surges were not enough to damage 
the fuel elements. This may be because the description of the core thermal-hydraulics 
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is inadequate. No information is given on the methods used by the Scientific 
Research and Design Institute for Power Technology in Refs [20] and [17] to calcu- 
late the thermal-hydraulic processes. 

The Commission cannot accept the conclusion drawn in Ref. [17], because the 
authors are unable to guarantee a high degree of accuracy and the reliability of the 
calculation techniques used. Moreover, the fact that the results are extremely sensi- 
tive to the slightest variations in the initial data is pointed out in the studies carried 
out by the Scientific Research and Design Institute for Power Technology [20] and 
other organizations [32]. The study in Ref. [28] has found that a slight variation in 
the initial neutron distribution significantly alters the characteristics of the accident 
process. Thus, within the limits of a 20% variation in initial power density, the rate 
of thermal power increase may be 400 MW/s or 1000 MW/s by 6 s to 7 s after the 
start of the transient. Accordingly, after 6.5 s, the total reactor power may be 31 or 
64 times higher than the initial level. The critical fuel enthalpy may be reached for 
either 5 or 40 fuel assemblies. 

In the Commission's opinion, the substantial fuel damage, indicated in 
Ref. [28] as a possibility in the event of a minor error in determining the initial volu- 
metric power density, did in fact happen. However, although the authors of Ref. [17] 
confirm the strong dependence of the results on slight variations in the initial data, 
they did not find initial values which would have given rise to the accident process. 
They conclude that there must have been some other factors, in addition to the 
unfavourable reactivity excursion caused by the RCPS rods, in order to account for 
the accident. The factors suggested include MCP cavitation, entry of non- 
equilibrium steam at the core inlet, switching off of the MCPs being run down prior 
to the EPS signal, coolant boiling at the reactor inlet, partial leaks in the lower water 
channels, and opening of the steam safety valves briefly. 

It is possible that, in future, quantitative proof may be provided for these 
scenarios, which were put forward at the very beginning of the investigation into the 
causes of the accident. However, during four years of investigation no organization 
has yet published any such proof. Nevertheless, in order to explain and, more impor- 
tantly, to correct the design characteristics of the reactor, the Commission thinks that 
it is sufficient to concentrate on the reactivity aspects of the accident caused by the 
design of the RCPS rods and the physical and thermal characteristics of the reactor, 
the most unfavourable aspects of which prompted the actions taken by the Chernobyl 
plant personnel. The Commission regards the list of organizational and engineering 
measures which were either immediately implemented or planned at Chernobyl type 
reactors [18, 25, 26, 39] as confirmation of the correctness of such an approach. 


I-4.7. Actions of the Chernobyl plant personnel 
The officially published documents on the causes of the Chernobyl accident set 


the blame mainly on the actions taken by the plant personnel. For this reason, the 
Commission feels obliged to present its own evaluation of the personnel's actions, 
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with two aspects in mind. Firstly, it is necessary to establish as full a list as possible 
of all the violations of the Operating Procedures [40] and other mandatory operating 
documentation. Secondly, an attempt must be made, using the available data, to 
assess retrospectively the effect of the violations on the causes and scale of the 
accident. 

The Commission would like to stress that its evaluations should in no way be 
regarded as condoning the violations of the regulatory documents committed by the 
personnel and designers. 


1-4. 7.1. 


During the decrease in power of Unit 4 on 25 April 1986 (at around 03:00) 
at a reactor power of about 2000 MW, the ORM fell to less than 26 manual control 
rods. The Operating Procedures for Units 3 and 4 (Section 9, Ref. [40]) allowed the 
units to be operated with an ORM of less than 26 manual control rods only after 
authorization by the Chief Engineer of the plant. 

During the further power reduction (at about 07:00 on 25 April), when the 
reactor power was 1500 MW, the ORM fell to 15 manual control rods. In such cases, 
according to the requirements of Section 9 of the Operating Procedures, the reactor 
should be shut down. The personnel did not abide by this requirement. The Commis- 
sion assumes that the personnel deliberately violated this requirement. The PRIZMA 
calculation code was found to be unreliable at this time, because it did not take into 
account the position of the rods of automatic regulators Nos 1, 2 and 3 (a total of 
12 rods). There is a note to this effect in the senior reactor control engineer’s operat- 
ing log. The Operating Procedures and other operating documentation did not 
prescribe the actions to be taken by personnel under such circumstances (in the event 
of unreliable calculation) and similar circumstances (for example, in the event of 
complete failure of the PRIZMA code to determine the ORM). Nevertheless, in 
allowing the reactor to operate at 1500. MW with an ORM of less than 15 manual 
control rqds, from.about 07:00 to 13.30 on 25 April, the plant personnel, including 
senior staff, violated the requirements. of Section 9 of the Operating Procedures, 
although this violation was not the cause of the accident and did not affect .its 
consequences. 


Notes: 


Section 12 of the Operating Procedures, concerning the planned shutdown and 
cooling of the reactor, did not contain any requirements regarding the monitor- 
ing and maintenance of the ORM. 


Section 12 states, in particular, that a power reduction must be carried out 
**using the set point adjusters of the automatic regulators to 160 MW<(th) 
(5% of nominal power), and then the automatic power control system or the 
EPS-5 button.” 
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In this connection it is important to make the following points. 


Firstly, Section 8.9.1(a) of the Operating Procedures refers to reactivity as one 
of the important operating parameters which have to be controlled at all power 
levels. The ORM is not included in the list of important parameters. 


Secondly, there was no provision in the design of the RBMK reactor for a 
device to measure the ORM in terms of effective manual control rods. The 
operator either had to determine the depth of insertion of rods in the inter- 
mediate position from the measuring instruments, correct for the non-linearity 
of the graduation scale and sum up the results, or instruct the plant computer 
to make the calculation and wait a few minutes for the result. In both cases, 
it seems unreasonable to expect the personnel to treat this parameter as a 
directly controllable one, particularly since the accuracy with which it can be 
determined depends on the power density field profile. 


Thirdly, the Operating Procedures did not draw the attention of the personnel 
to the importance of the ORM as an essential parameter for ensuring the effect- 
iveness of the emergency protection system. 


In fact, post-accident calculation studies have shown that full withdrawal of the 
manual control rods from the core, which is not prohibited in other reactors, such 
as WWER reactors, was unacceptable for the RBMK reactor, owing to the design 
of the manual control rods. Withdrawal of more than a certain number of RCPS rods 
from the core resulted in the concentration of too much positive reactivity in the 
lower part of the core in terms of displaceable water columns. 


1-4.7.2. 


At 14:00 on 25 April the personnel, in accordance with Section 2.15 of the test- 
ing programme [41], closed the manual isolating slide valves of the ECCS, thereby 
disconnecting it from the MFCC, in order to avoid penetration of water into the 
MFCC in all three ECCS subsystems. Section 2.10.5 of the Operating Procedures 
states that during heating of the MFCC after a scheduled preventive maintenance out- 
age, when the temperatures exceed 100°C, ‘‘the ECCS must be brought to a state 
of readiness.” At the same time Section 2 of the Procedures for Reswitching Keys 
and Straps of the Engineered Protection and Blocking Systems [42] authorized the 
Chief Engineer of the plant to switch off automatic actuation of the ECCS. This is 
tantamount to switching off the fast acting part of the system and, therefore, the 
whole ECCS. The Commission notes, firstly, that taking the ECCS out of operation 
is a violation of Section 2.10.5 of the Operating Procedures and, secondly, that 
switching off the ECCS did not affect the initiation and development of the accident, 
since the chronology of basic events before and during the course of the accident 
showed that no signals for the automatic switching on of the ECCS were recorded. 
Under the specific conditions on 26 April 1986, it is therefore not true to state that 
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an opportunity of reducing the severity of the accident was lost [30] because the 
ECCS was switched off. 


1-4. 7.3. 


At 00:28 on 26 April (according to the operating logs), the personnel failed 
to control the reactor and, as a result, there was an unforeseen reduction in the 
thermal power of the reactor to 30 MW. On the basis of the incomplete information 
available it is very difficult to make an unambiguous analysis of the reasons for the 
power reduction. The senior reactor control engineer noted in the operating log at 
00:28: Тһе working range emergency power increase rate protection system is 
switched on. The automatic regulator set point has been reduced by the ‘fast power 
reduction’ button. Automatic regulator No. 1 is switched on. The unacceptable 
imbalance with respect to automatic regulator No. 2 has been eliminated. Automatic 
regulator No. 2 is оп standby.” Having analysed this note and the data recorded by 
the DREG program and the RCPS operating algorithm, the Commission presumes 
that the following events happened during that period: 


— For some unknown reason (possibly owing to a perturbation associated with 
the MFCC: either a variation in the feedwater flow rate or steam pressure in 
the steam separator drums) the local automatic regulator was switched off and 
automatic regulator No. 1 came into an automatic regime and, in responding 
to the negative imbalance, moved to the upper limit stop switch. 

— Automatic regulator No. 2, in response to the positioning of the automatic 
regulator No. 1 at the upper limit stop switch, did not come into automatic 
mode owing to an unacceptable imbalance in its measuring circuit. 

— When all the regulators came out of automatic regime, the working range 
emergency power increase rate protection system was put on standby and an 
illuminated indicator ‘working range emergency power increase rate protec- 
tion system is on’ appeared on the board of the senior reactor control engineer. 

— As a result of the continued ‘poisoning’, the reactor power started to fall; the 
unacceptable imbalances in the measuring circuits of automatic regulators 
Nos 1 and 2 increased; ‘failure in measuring circuit of automatic regulator 
No. 1’ and ‘failure in measuring circuit of automatic regulator No. 2’ signals 
actuated and the corresponding illuminated indicators were displayed on the 
board of the senior reactor control engineer and were recorded by the DREG 
program; the senior reactor control engineer probably reduced the set points 
of the power regulators using the ‘fast power reduction button’ at a rate of 2% 
per second, managed to compensate for the imbalance in the measuring circuit 
of automatic regulator No. 1 and put it into automatic operating mode. 

— Then, by manipulating the set points of automatic regulator No. 1, the senior 
reactor control engineer began to restore power to create the conditions for 
carrying out the tests. 
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Note: 


Additional comments on the event that occurred at 00:28 are necessary. 


The recording device of the physical power density distribution control system 
(PPDDCS) did not record the reduction in thermal power below 30 MW. Dur- 
ing this time for about 5 min the neutron power recorder recorded zero power, 
after which the neutron power curve reached a level corresponding to 
30-40 MW on the PPDDCS recorder. The low power level and correspond- 
ingly low accuracy with which it was determined by the built-in control devices 
mean that the reactor power actually fell to the minimum controllable level. 
According to Section 6.7 of the Operating Procedures, a power reduction to 
any level, but not below the minimum controllable power level, was regarded 
as a partial unit power reduction. The same section of the Operating Proce- 
dures authorized the power then to be restored to the rated value. 

Here it is worth drawing attention to the contradictory nature of the instructions 
in the operating documentation. Section 6.1 of the Operating Procedures 
defined a short term shutdown as ‘‘a reactor power reduction to zero without 
cooling of ше MFCC.'' However, it does not indicate what type of power is 
meant. If neutron power is meant, then the personnel violated the Operating 
Procedures; if thermal power is meant, there was no violation (according to 
the indications on the tapes of the recording instruments). 


The Commission notes that the regulations and operating documentation in 
force at that time did not contain clear definitions of ‘minimum controllable 
power level’ and ‘shutdown reactor’ as applied to the power manoeuvre that 
took place. 


The authors of this report believe that the drop in reactor power at 00:28 and 
subsequent power increase were largely to blame for the tragic consequences 
of the accident. The change in reactor operating conditions between 00:28 and 
00:33 gave rise to a new xenon reshaping of the power density fields which 
the personnel were unable to control (see section 3.4 of this report 
[Section I-3.4]). No calculational studies have been made of the power density 
field dynamics from this time until the time of the accident. 


It is impossible to draw a final conclusion on whether or not the personnel 
actions were correct under these specific circumstances because of the afore- 
mentioned contradictory nature of the requirements in the Operating Procedures, and 
the inadequacy and contradictory nature of the data recorded by the instruments. No 
calculational analysis of this situation has been made so far. 


1-4. 7.4. 


The drop in reactor power was accompanied by a reduction in the water level 
and steam pressure in the steam separator drums. The water level in the steam sepa- 
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rators fell below the emergency set point of —600 mm without triggering the EPS-5 
signal to actuate the RCPS. The Commission notes that during the reactor power 
reduction personnel did not switch from EPS-1 with a set point of — 1100 mm to 
EPS-5 with a set point of — 600 mm in response to the low water level in the steam 
separators. There are no notes on this in the operating logs. These personnel actions 
were in violation of Section 9 of the Procedures for Reswitching Keys and Straps 
of the Engineered Protection and Blocking Systems [42]. However, the Commission 
notes that another protection system against water level reduction in the steam sepa- 
rator drums below the —1100 mm level existed and was brought into operation. The 
set point of this protection system did not depend on the power. The statement made 
in Ref. [1] that ‘all the thermal parameter reactor protection systems were switched 
off” is therefore not true. 


Note: The reasons for transferring the functions of the EPS to the personnel 
owing to the lack of appropriate engineered safety features can be seen from 
the example of the reactor protection system against water level reduction in 
the steam separator drums. The designers made it clear in Ref. [43] that: 
"Automatic reswitching of the set points of EPS-1 and EPS-5 during emer- 
gency fluctuations of the water level in the steam separator drums is not per- 
mitted, since during operation of any of the emergency protection systems 1, 
2 and 3 the water level falls to the —600 mm set point on the instrument which 
has a range of +400 to — 1200 mm. This, in turn, will result in actuation of 
EPS-5 and complete shutdown of the reactor." They found an extremely 
simple way out of this: ‘‘Instead of automatic reswitching of the set points and 
automatic actuation (deactuation) of EPS-5 in response to a reduction in the 
feedwater flow rate the operator should reswitch them manually using the 
general key when alarm signals appear...’ 


It is not for us to demonstrate the feasibility of solving this problem using 
engineered safety features (this is feasible), but rather to demonstrate that in cases 
where there was a choice between complying with the safety requirements and shut- 
ting down the unit, or giving priority to economic considerations and keeping the unit 
in operation, the choice used to be made in favour of the second alternative, with 
the functions of the emergency protection system being transferred to the operator 
with a deep faith in the operator's complete reliability as a component of the safety 
system. | 

At 00:36:24 the personnel changed the set point for switching off the turbine 
of the protection system to guard against reduction in steam pressure in the steam 
separator drums from 55 kgf/cm? to 50 kgf/cm?. These personnel actions were in 
accordance with requirements of the operating documentation since, according to 
Section 12 of the Procedures for Reswitching Keys and Straps of the Engineered 
Protection and Blocking Systems [42], personnel were entitled to select this set point. 
Contrary to what is stated in official documents, the Commission does not consider 
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that personnel should be held to blame for having blocked the steam pressure protec- 
tion system of the steam separators. 


Note: It should be stressed that the protection system to guard against a reduc- 
tion in steam pressure in the steam separators was designed to stop the turbine 
and was not ‘‘a thermal parameter reactor protection system’’, as described in 
Ref. [1]. In the interests of objectivity, the authors of Ref. [1] should have 
pointed out that the design was such that at a turbine power of less than 
100 MW(e) the reactor was left without any protection system to guard against 
pressure reduction. At the actual a, it might have resulted in a reactor runa- 
way even at the regulatory ORM (for example, in the event of the opening or 
non-closing of the main pressure relief valves, or the valves of the fast acting 
steam dump system, pipe rupture, etc.). 


1-4. 7.5. 


At 00:41 (according to operating logs of the plant shift supervisor, the unit shift 
supervisor, the electrical workshop shift supervisor and the senior turbine control 
engineer) turbogenerator No. 8 was disconnected from the system to determine the 
turbine vibration characteristics during rundown. This procedure was not envisaged 
in the turbogenerator No. 8 rundown test programme. Measurements of the vibra- 
tions of turbogenerators Nos 7 and 8 at different loads were planned in a different 
programme, which had already been partially implemented by the personnel on 
25 April during alternate redistribution of the turbine generator loads at a constant 
thermal reactor power of 1500-1600 MW. The disconnection of turbogenerator 
No. 8 from the system, together with the disconnection of the other turbogenerator 
(turbogenerator No. 7 was stopped at 13:05 on 25 April) without shutting down the 
reactor meant that the EPS-5 system to protect the reactor in the event of the shut- 
down of two turbogenerators had to be disabled. The personnel did this in accor- 
dance with Section 1 of the Procedures for Reswitching Keys and Straps of the 
Engineered Protection and Blocking Systems [42], which provided for the disabling 
of this protection system in the event of a turbogenerator load of less than 
100 MW(e). The Commission believes that the personnel cannot be blamed for 
disabling the reactor protection system which shuts down the reactor in the event of 
the closure of the emergency stop valves of both turbines. 


1-4.7.6. 


By 01:00 on 26 April, the power increase had ceased and the reactor power 
was stabilized at about 200 MW(th). The decision to carry out the turbogenerator 
No. 8 rundown tests at a reactor power of about 200 MW was a departure from the 
testing programme. However, neither the design documentation, the regulatory 
documentation nor the operating documentation prohibited operation of the unit at 
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that power. Before the Chernobyl accident there were по safe operating limits in 
terms of minimum permissible thermal reactor power. In none of the documents 
studied by the Commission relating to the analysis of the operating conditions of the 
ВВМК-1000 reactor do the reactor designers raise the question of the need to limit 
reactor operation at power levels below a certain level. Moreover, Section 11.4 of 
the Operating Procedures required personnel to reduce the reactor power to the level 
corresponding to the unit’s internal consumption (200-300 MW(th)) following auto- 
matic power reduction in the EPS-3 design mode, or remotely in the event of abnor- 
malities in the power supply system (frequency variations). There was no limitation 
on the period during which the reactor could operate at the minimum controllable 
power level. 


Note: The Operating Procedures permitted operating conditions similar to 
those prevailing at Chernobyl Unit 4 on 26 April 1986 and they might have 
occurred without any intervention on the part of the personnel. We only need 
to assume a perfectly possible situation in which triggering of EPS-3 occurs 
when the reactor is operating initially at rated power with an ORM of 
26 manual control rods. Under these conditions, approximately one hour after 
triggering of EPS-3 the ORM could have fallen to less than 15 manual control 
rods at a reactor power of 200-300 MW(th), and any further action, whether 
automatic or remote, to shut down the reactor could have led to a similar repe- 
tition of the events of 26 April 1986. 


The Commission considers that the personnel cannot be held to blame for oper- 
ating the unit at a power of less than 700 MW. 


1-4. 7. 7. 


At 01:03 and 01:07, in accordance with Section 2.12 of the testing programme 
[41], one MCP from each side (MCP Nos 12 and 22) was also switched on ‘‘to cool 
down the reactor during the test.’’ Before 26 April 1986 no document, including the 
Operating Procedures, prohibited connection of all eight MCPs to the reactor at any 
power level. In the Commission’s view, the personnel committed no violations by 
these actions. At the same time, at low power levels when the feedwater flow rate 
is less than 500 t/h, the Operating Procedures limited the capacity of each MCP to 
6500-7000 m?/h in order to prevent cavitation. On 26 April 1986 the flow rates of 
certain MCPs actually exceeded the limit (violation of Section 5.8 of the Operating 
Procedures), but did not cause cavitation of the pumps, as is evident from the DREG 
program printout and is confirmed by the studies carried out by the Mechanical 
Engineering Experimental Design Office and other organizations. Reference [31] 
points out that **both the pumps being run down and those not being run down main- 
tained a steady water supply, even during the runaway and destruction of the 
reactor." 
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1-4. 7.8. 


The Commission’s analysis of the actions of personnel during the preparations 
for and implementation of the tests shows that the personnel committed the following 
violations of the requirements of the operating and regulatory documentation: 


— Reactor operation with an ORM of 15 manual control rods or less from 07:00 
until 13:30 on 25 April and from approximately 13:00 on 26 April until the 
time of the accident (violation of Section 9 of the Operating Procedures); 

— Complete disconnection of the ECCS (violation of Section 2.10.5 of the Oper- 
ating Procedures); 

— Change in the set point of the reactor protection system to guard against 
reduction in water level in the steam separator drums from —600 mm to 
—1100 mm (violation of Section 9 of the Procedures for Reswitching Keys and 
Straps of the Engineered Protection and Blocking Systems [42]); 

— Increase in flow rates of certain MCPs to 7500 m?/h (violation of Section 5.8 
of the Operating Procedures). 


In addition, the personnel made certain deviations from the testing programme 
(see sections 4.7.5 and 4.7.6 of this report [Sections /-4.7.5 and 1-4.7.6]). Conclu- 
sions about the personnel actions after the drop in power (Section 4.7.3 of this report 
[Section 1-4.7.3]) can only be drawn after further studies have been carried out. 


1-4.7.9. 


To conclude this section, the Commission thinks it necessary to summarize 
*'the most serious violations of the operating documentation committed by the per- 
sonnel at Unit 4 of the Chernobyl nuclear power plant’’ [30] in terms of their impact 
on the causes and the consequences of the accident. 

In the Commission's view, the switching off of the ECCS did not affect the 
initiation and scale of the accident. 

It would appear that the connection of eight instead of the usual six MCPs to 
the reactors if anything hindered the reactor runaway, which was initiated and 
developed independently of the operating conditions of the pumping group and the 
temporarily increased coolant flow rates through certain MCPs. Additional theor- 
etical analysis in this area is required. 

The changes made to the set points and deactivation of the engineered protec- 
tion and blocking systems were not the causes of the accident and did not affect its 
scale. These actions were not in any way related to the emergency protection systems 
of the reactor itself (relating to power level, power increase rate), which the person- 
nel did not deactivate. 

The change in the initial reactor power before the tests and subsequent con- 
tinued power reduction made it necessary for actions to be taken to control the unit 
which were not foreseen in the test programme. This increased the risk of incorrect 
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actions, аз demonstrated by the unauthorized reduction of reactor power to the mini- 
mum controllable level followed by its increase, which had an extremely negative 
effect on the subsequent behaviour of the reactor. 

The low reactor power level increased the likelihood of the positive reactivity 
effect which manifested itself at a maximum not only as a result of local power 
density increases, but also for some other reasons (for example, coolant leakage). 
The choice of power level therefore affected the scale of the accident. No matter how 
paradoxical it may seem, low power levels proved to be the most dangerous ones 
and the safety of the reactor at these levels had not been studied or analysed in the 
design documentation. 

Had the tests been carried out at a power level of 700 MW(th), as was initially 
planned, the accident might not have happened. However, this theory needs to be 
tested by studies which have not yet been carried out. 


I-4.8. Operating reactivity margin 


The ORM is one of the most important aspects of the Chernobyl accident. 

In addition to the information presented in sections 4.7.1 and 4.7.3 
[Sections 1-4.7.1 and I-4.7.3] of this report, in which the Commission analyses the 
actions of the personnel in terms of their compliance with the Operating Procedures, 
it should be noted that post-accident studies have shown that the way in which the 
real role of the ORM is reflected in the Operating Procedures and design documenta- 
tion for the RBMK-1000 is extremely contradictory. 

Section 9 of the Operating Procedures, Normal Operating Parameters of the 
Unit and Permissible Deviations, points out that: 


** At nominal power during steady state operation, the ORM should be not less 
than 26-30 rods. | 

**Reactor operation atan ORM of less than 26 rods must be authorized by the 
Chief Plant Engineer. 

“When the ORM falls to 15 rods, the reactor should be shut down 
immediately. 

“Тһе scientific managers of the plant must periodically (once a year) examine 
the specific regulations designed to maintain steady power density fields at the 
particular unit and, if necessary, change them to make them stricter, in agree- 
ment with the Scientific Manager and the Chief Design Engineer.” 


Note: In the Commission's view, the concepts of ‘‘scientific managers of the 
plant" and ‘‘making the specific regulations designed to maintain steady power 
density fields stricter’’, which are used in the Operating Procedures but not 
defined in those Procedures or in the regulatory documents in force at that 
time, are rather loose concepts. 
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The contradictory nature of the directives concerning the ORM is also illus- 
trated by the following extracts from the Operating Procedures which are associated 
with the situation at 00:28 (drop in reactor power): 


**6.2. Reactor power rise after a short term shutdown when there has been no 
iodine poisoning of the reactor is permitted only if there is the required opera- 
tional reactivity margin, which is determined from the margin prior to the shut- 
down of the reactor. The required operational reactivity margin as a function 
of the power level at which the reactor was operating prior to shutdown is 
given in the Table” [see Table I-II]. 


TABLE I-II. REQUIRED OPERATING REACTIVITY MARGIN AS A FUNC- 
TION OF REACTOR POWER LEVEL? 


Required ORM 
(Equivalent number of manual 
control rods) 


Reactor power level 
(Percentage of nominal) 


80-100% 50 
50-80% 45 
<50% 30 


* From the Operating Procedures. 


‘6.6.4. The minimum operational reactivity margin during a power rise 
following a short term shutdown must not be less than 15 rods. 

“И in withdrawing manual control rods while the reactor is being brought to 
criticality the operational reactivity margin falls to 15 rods and continues to 
fall, all rods must be dropped to the lower limit stop switches...” 


From these extracts from the Operating Procedures, the following conclusions 
can be drawn: 


— Firstly, the Operating Procedures unambiguously treat the ORM as a way of 
controlling the power density field; 

— Secondly, the incorrect indication about the possibility of lowering the ORM 
to less than 15 manual control rods shows that the ORM was not treated as an 
operational safety limit, violation of which could lead to an accident. 


Note: The design documentation also contains equally contradictory directives 
concerning the ORM. For example, in Ref. [44] it is stated that: ‘‘At rated 
power during steady state operation, the ORM should not be less than 26, and 
not more than 35, manual control rods. On the authorization of the Chief Plant 
Engineer, a reactor may be allowed to operate with an ORM below the mini- 


80 


mum value, but for no longer than three days. Operation of the unit is not per- 
mitted at an ORM of less than 10 rods." 


Thus the ORM is not regarded in the Operating Procedures as an indicator of 
the ability of the EPS to perform its functions. This is natural, since such an under- 
standing would be regarded as an unlawful transfer of reactor protection functions 
by designers from engineered safety features to the personnel, and to its ability to 
work ‘‘in the plant computer operating mode'' (see note to section 4.7.1 of this 
report [Section 1-4.7.1]). The design documentation also did not treat the ORM as 
a critical parameter requiring a protection system (see sections 3.3 and 3.7 of this 
report [Sections 1-3.3 and 1-3.7]). 

However, in the Commission's opinion, the main point is that having realized 
the full extent of the danger of reducing the ORM in terms of the ability of the EPS 
to perform its functions, the designers did not inform the operating personnel accord- 
ingly of this fact, who if they had realized the danger might not have taken upon them- 
selves the function given to them by the designers to protect the reactor from a 
runaway. 

Tn fact, in 1984, when the positive reactivity insertion effect, which was caused 
by the design of the RCPS rods and which had not been foreseen at the design stage, 
manifested itself during experiments, the Chief Design Engineering Organization 
informed other organizations and all plants with RBMK reactors that it intended to 
restrict the number of RCPS rods which could be completely withdrawn from the 
core to not more than 150 rods, while the remaining rods would have to be sub- 
merged in the core by at least 0.5 m [22]. 

In the light of our present knowledge acquired from the post-accident studies, 
we can interpret the proposed limitation in the following way. 

Since the axial power density field distribution in the RBMK reactor can have 
a specific instability determined by the saddle point at the mid-point of the core 
(a double peaked field) at which insertion of a manual control rod introduces positive 
reactivity in the lower part of the reactor and negative reactivity in the upper part 
(the 'rocker' effect), the total positive reactivity introduced can be reduced by 
preventing the formation of water columns above a certain permissible value. This 
can be achieved if the complete withdrawal of the relevant number of rods is 
prohibited. This decreases the ‘explosive’ reactivity effect of the manual control rod 
displacer which replaces the water column in the lower part of the core, while the 
absorbing part of the rod is located in the neutron flux. The majority of RCPS rods 
will have the same effect on the reactor reactivity, only this will occur more than 
one second after the EPS-5 command. 


Note: In view of the strong dependence of the reactor's runaway capacity on 
the number of manual control rod absorbers and water columns under their 
displacers located in the core, it is rather difficult to add up the lengths of the 
partially submerged manual control rods in order to calculate the effective 
ORM (at least for the design of the RCPS rods at the time of the accident). 
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However, despite the obvious importance of фе ORM parameter in terms of 
the effectiveness of the EPS, the appropriate changes were not made to the Operating 
Procedures before 1986 and no explanations were given to the personnel of plants 
with RBMK reactors. In any situation ‘‘the personnel had the right to expect, under 
any operating conditions, that the EPS would function and effectively terminate the 
chain reaction and prevent runaway of the reactor” [45]. However, that was not the 
case and right up to the time of the accident, the personnel at units with RBMK reac- 
tors had no idea that the ORM value (for the design of the RCPS rods which existed 
at the time of the accident) not only determined the ability to control the reactor 
power density field but, primarily, determined the ability of the reactor's EPS to 
perform its functions. 

After the RCPS rods had been redesigned (the water columns beneath the 
displacers removed), the Chief Design Engineer could legitimately state, four years 
after the accident, that: ‘‘with respect to the RBMK reactor this matter (concerning 
the ORM) has been thoroughly studied and it has been determined that for optimum 
power density control, an ORM of 26-30 manual control rods is necessary” [36]. 
Now, this is the case. However, the Commission has to stress that the ORM values 
now in force (43-48 manual control rods for steady state operation and 30 manual 
control rods as the limit below which a reactor is to be shut down) differ considerably 
from those established before the accident. 


Note: It is evident that at plants with RBMK reactors many functions of the 
EPS (including its function when the ORM reaches a critical value) were trans- 
ferred to the personnel with a deep faith in the personnel's absolute reliability 
as a component in the complex and ramified reactor safety system. Four-and-a- 
half years after the accident, representatives of the Scientific Manager 
acknowledged the mistakenness of this concept: ‘‘Many years of accident free 
operation of military reactors in the USSR led to the deep rooted philosophy 
that one only has to write correct reactor operating instructions to guarantee 
safety. It goes without saying that these instructions are mandatory for the per- 
sonnel. It turned out that the real situation was very different. The first most 
important lesson to be learnt from Chernobyl is that the safety of nuclear power 
plants cannot be based on instructions. If a particular parameter exceeds certain 
limits, the reactor must be shut down automatically without the intervention of 
the operator. Furthermore, measures must be taken to exclude the possibility 
of an automatic protection system being deliberately switched off’ [14]. 


To that correct, but late, statement must be added the comment that it is 
difficult to claim that the RBMK operating instructions in force prior to 1986 were 
correct. 
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I-4.9. Causes of the accident 


The event which initiated the accident was the pressing by the senior reactor 
control engineer of the EPS rod drop button (EPS-5) to shut down the reactor for 
some reason which has not yet been established for certain. 

The cause of the accident was an uncontrolled increase in reactor power which 
initially arose because of the increase in reactivity caused by the displacers of the 
RCPS rods [17, 28, 35]. 

The increase in reactivity was not suppressed by the absorbers of RCPS rods, 
not only because of their slow speed, but also because the operating personnel had 
withdrawn more than the permitted number of manual control absorbing rods from 
the core before the tests, thereby creating the conditions for a multiple increase in 
intensity of the initial reactor runaway, which was predetermined by the design of 
the RCPS rods. 

The initial reactivity increase resulted in a substantial growth in power since 
there was strong positive feedback between reactor reactivity and steam generation 
in the core. This process was considerably enhanced by the low initial reactor power, 
by the thermal-hydraulic characteristics that promoted maximum realization of the 
steam reactivity effect, and by significant power density irregularities throughout the 
core. 


Note: 

The causes of the accident have been analysed in many documents and their 
complexity has been noted. In particular, Ref. [46] presents a concise view of 
the causes of the accident: 


** An analysis of the Chernobyl accident has identified: the major role played 
by the displacers; the large void reactivity effect; and the formation of 
extremely large volumetric power density irregularities in'the core during the 
accident. This last fact is one of the most important ones and is:caused by the 
.large dimensions of the core (7 m x 12 т), the slow speed of movement of 
the non-uniform rods (having. absorbers, displacers and water columns) 
(0.4 m/s), and: the large void reactivity effect (58._). All these factors 
predetermined the scale of the Chernobyl accident. 
*" Thé scale of the-Chernobyl accident was therefore not determined by person- 
nel actions, but by a.lack of understanding, primarily on the part of the scien- 
tific managers, of the effect of steam quality on the reactivity of the RBMK 
core. This led to an incorrect analysis of the operational safety; tó a disregard 
of repeated manifestations of the.large void reactivity effect during operation; 
to a false confidence in the effectiveness of the.RCPS which, in fact, failed to 
cope with both the Chernobyl accident and many others, in particular with 
DBAs; and, naturally, to the formulation of incorrect operating procedures. 
*"This inadequate level of scientific management is explained, above all, by the 
following: 
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— the extremely low number of studies of the neutron physics processes taking 
place in the RBMK core; 

— a disregard for discrepancies in the results obtained using different methods; 

— the lack of experimental studies under conditions close to the natural ones; 

— the lack of analysis of specialized publications; and 

— in the long run, the transmission to the Chief Design Engineer of incorrect 
techniques for calculating the neutron physics processes used to analyse the 
processes taking place in the core and the safety of plants with RBMK reactors. 
“К is also an important point that for a long time the USSR Ministry of Power 
had been operating plants with RBMK reactors with neutron physics instabili- 
ties in the core, but did not take sufficient notice of the repeated unusual signals 
of the emergency power protection system and of the emergency power 
increase rate protection system following triggering of the EPS, and did not 


demand thorough investigations of emergency situations. 
““.., We are bound to conclude that an accident such as that at Chernobyl was 


inevitable.'' 


I-5. CONCLUSIONS 


The Chernobyl accident was examined and analysed by the International 
Atomic Energy Agency's International Nuclear Safety Advisory Group (INSAG), a 
body which provides advice to the IAEA Director General [47]. Without going into 
the details of that report, the Commission notes that in analysing the root causes of 
the Chernobyl accident, INSAG concluded that the need to create and maintain a 
*safety culture' is a precondition for ensuring nuclear power plant safety. 

The concept of ‘safety culture’ relates to a very general concept of dedication 
and personal responsibility of all those involved in any safety related activity at a 
nuclear power plant. Inculcation of a safety culture requires that, in training person- 
nel for nuclear plants, particular emphasis be placed on the reasons for the establish- 
ment of safety practices and on the consequences in terms of safety of failures on 
the part of personnel to perform their duties properly. Special emphasis must be 
placed on the reasons for the establishment of safety limits and the consequences in 
terms of safety of violating them. Safety culture presupposes total psychological 
dedication to safety, which is primarily created by the attitude of the administrative 
staff of the organizations engaged in the development and operation of nuclear power 
plants [48]. 

In INSAG publications, the concept of safety culture has been extended beyond 
the purely operational aspects to cover all types of activities at all stages in the life- 
time of a nuclear power plant which may affect its safe operation. It even covers the 
highest spheres of administration, including the legal and governmental ones which, 
according to the concept, must create a national climate in which attention is paid 
to nuclear safety on a daily basis. If the Chernobyl accident is assessed in terms of 
this safety culture concept, it can be seen that not only those involved in the opera- 
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tional stage lacked ап adequate safety culture, but also those involved in other stages 
of the lifetime of a nuclear power plant (designers, engineers, constructors, equip- 
ment manufacturers, ministerial and regulatory bodies, etc.). 

Taking into account the facts presented in this report and the preamble to this 
section, the Commission arrived at the following conclusions. 


I-5.1. Design deficiencies of the RBMK-1000 reactor at Chernobyl Unit 4 
predetermined the severe consequences of the accident 


The Chernobyl disaster was caused by the choice made by the RBMK-1000 
reactor designers of a design which did not take adequate account of the safety issues 
involved. As a result of that choice, the physical and thermal-hydraulic characteris- 
tics of the reactor core contradicted the principles of dynamically stable safe systems. 
In accordance with this design concept, a reactor control and protection system was 
designed which did not meet the safety requirements. The unsatisfactory physical and 
thermal-hydraulic characteristics of the reactor core in terms of safety were aggra- 
vated by errors made in the design of the RCPS. 

The possible consequences of operating a reactor with such dangerous charac- 
teristics were not indicated in the design, the engineering or, consequently, in the 
operating documentation. Designers at the highest level kept asserting that the 
ВВМК reactor was extremely safe. This resulted in complacency on the part of the 
personnel with regard to the reactor facility that contradicted the awareness of 
*danger' inherent in the concept of safety culture. 

The reactor designers were aware that the dangerous property of the reactor 
they had developed could be a cause of nuclear instability, but failed to estimate 
quantitatively its possible consequences and attempted to protect themselves by 
imposing operating limitations which, as it turned out, provided extremely poor pro- 
tection. Such an approach has absolutely nothing to do with safety culture. 

Another point must beemade. The aforementioned poor protection system 
against the very dangerous consequences of an unstable reactor does not fit in with 
the defence in depth principle on which the development of nuclear power in the rest 
of the world has been based. 

The design parameters and characteristics of the RBMK-1000 reactor on 
26 April 1986 violated the safety standards and regulations so seriougly that it could 
only be operated in a country where there was an inadequate safety culture. 


1-5.2. The misguidedness of the practice of transferring emergency protection 
functions to the human operator owing to the lack of appropriate 
engineered safety features was highlighted by the accident itself: the 
combination of design deficiencies and the non-total reliability of human 
operators brought about the disaster 


The personnel violated the Operating Procedures and the Commission notes 
these violations in this report. Some of these violations did not affect the initiation 
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and development of the accident, others created favourable conditions for the 
manifestation of the negative design characteristics of the RBMK-1000 reactor. The 
violations were largely the result of the poor quality of the operating documentation 
and its contradictory nature caused by the poor quality of the RBMK-1000 reactor 
design. 


The personnel were unaware of some of the dangerous features of the reactor 
and, therefore, did not realize the consequences of the violations. This fact in itself 
demonstrates the lack of safety culture, not so much on the part of the personnel, 
but rather on the part of the reactor designers and the operating organization. It is 
worth looking at another approach to the analysis of the causes of an accident and 
the role of personnel actions in its initiation and development. After the serious acci- 
dent at the Three Mile Island plant in the USA in 1979, the designers did not seek 
to blame the personnel, since ‘еу [the engineers] may analyse the first minute of 
an accident for hours or even weeks, seeking to understand what happened or trying 
to project what will happen next if parameters are manipulated" ', whereas an opera- 
tor has to deal with ‘‘hundreds of thoughts, decisions and actions he takes during а 
transient’ (see Ref. [49], рр. 644-645). Experts in the USA understood that ''some 
transients can be avoided completely through good design. If a transient. can 
be imagined, a contingency can be designed to cope with й” ([49], p. 644). 
E.R. Frederick, the American operator who made erroneous decisions on the night 
of 28 April 1979, but was not prosecuted for them, writes: ‘Ном I have wished to 
go back and change those two decisions. But the event cannot be undone — and it 
must not happen again. Ап operator must never be placed in a situation which an 
engineer has not previously analysed. An engineer must never analyse a situation 
without observing an operator's reaction to it’’ ((49], p. 647). 


The ambiguities associated with the problem of human operators and the rea- 
sons for operator errors are beginning to be understood by Soviet experts: ‘Опе has 
to admit that, unfortunately, the study of human nature is still given low priority by 
developers of new technologies and, probably, by engineering circles in general. It 
is very difficult for a technocratic mind to understand the fact that the psychological 
motivation for an operator's actions is different from that motivating the actions of 
someone carrying out research, manufacturing equipment, or making adjustments or 
carrying out repairs. This failure to understand an operator's errors of course applies 
not only in the field of nuclear power” [50]. 


The priority given to economic factors and electricity production has always 
been, and still is, a dominating principle of nuclear power management. The system 
of incentives and penalties for operating personnel, still in existence at the majority 
of nuclear power plants, is based on this principle. In the event of a conflict between 
economics (planned power production) and safety, this system encourages operating 
personnel to decide in favour of the former. This also played a role on 26 April 1986 
at the Chernobyl plant when the personnel encountered difficulties with the test 
programme and certain violations of the Operating Procedures were committed as 
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а result of a long standing habit of ensuring that the goal that was set was achieved 
at all costs. 


I-5.3. The system of legal, economic and sociopolitical.correlations that existed 
prior to the accident and still exists in the field of nuclear power has no 
legal basis, and did not and does not meet the requirements of ensuring 
the safe utilization of nuclear power in the USSR 


This conclusion is based on the fact that when there is no.law governing the 
utilization of nuclear power, no one bears the full responsibility for the safety of 
operating nuclear power plants. All those involved in the development and operation 
of nuclear power plants are responsible only for those parts of the job which they 
perform themselves. According to international standards and practices this overall 
responsibility should be borne by the operating organizations. So far, the USSR does 
not have any such organizations. Their functions of making the most important 
general decisions concerning a plant as a whole were and are usually performed by 
the corresponding ministries, which are government authorities. As a result, the 
decision making is separated from the responsibility for the decisions. Moreover, 
following the repeated reorganization of government authorities, those bodies which 
made crucial decisions earlier no longer even exist. As a result, there are dangerous 
facilities for which no one is responsible. 

According to general international practice formulated in the IAEA recommen- 
dations [51] and officially recognized by the USSR [52], the final responsibility 
towards the population and the country as a whole for the safe operation of a plant 
always rests with the operating organization. However, responsibility cannot be 
borne without the corresponding rights. The system which existed, and still exists, 
does not give any rights either to the plants themselves, or to the higher authority, 
which together perform the duties of an operating organization. 

According to the current standards and regulations, these organizations are not 
empowered to make any crucial decisions (and after the Chernobyl accident also not 
any less important ones; in fact, to all intents and purposes, no decisions) without 
clearance by the Chief Design Engineer, the Scientific Administrator, the General 
Designer and the regulatory body. At the same time, all these organizations which 
force owners to make decisions and do not allow them any choice apart from termi- 
nation of the operation of the plant in the case of a disagreement, carry no responsi- 
bility themselves for the decisions made (except for the regulatory body, which is 
also wrong). 

This report identifies many violations in the design of Chernobyl Unit 4 of the 
safety standards and regulations in force at the time of the design, construction and 
operation of the plant. Nevertheless, the design was approved and authorization 
given for construction by all the relevant authorities and regulatory bodies. This 
demonstrates the lack in the USSR of a well organized group of experts endowed 
with its own resources, rights and responsibilities for its decisions. 
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The USSR State Committee for the Supervision of Nuclear Power Safety was 
established only three years before the Chernobyl accident and, notwithstanding the 
safety culture concept, it could not be regarded as an independent body, since it was 
part of the same state authorities responsible for the construction of nuclear power 
plants and electricity generation. Since the accident, a number of major changes have 
been made to the system for the supervision of safety in nuclear power. However, 
since the regulatory bodies have no legal basis, no economic methods of control, and 
no human and financial resources, and since it is very difficult to set up an institute 
of independent experts in this country, the system that existed and still exists is one 
consisting of many links providing step by step control and finicky supervision of 
nuclear power plants, rather than a full blooded regulatory system for the safe use 
of nuclear energy in the interests of the whole population. 

One of the most important lessons learned from the Chernobyl accident is not 
only the need to improve the specific parameters and operating conditions of the 
RBMK reactors, no matter how important this is in itself, but also the need to incor- 
porate the requirements of the ‘safety culture’ concept into all aspects of nuclear 
energy applications in the USSR. 


I-5.4. The studies of the causes and circumstances of the Chernobyl accident 
must not be regarded as complete and they must be continued to estab- 
lish the truth and to learn important lessons for the future 


Since 26 April 1986, considerable efforts have been made to analyse the causes 
and circumstances of the accident. However, this work must not be regarded as com- 
plete. A vast number of calculations and possibly experimental studies will have to 
be carried out *'in order to ensure that no safety significant event goes undetected 
and to introduce the necessary design improvements to prevent a recurrence of safety 
significant anomalous events anywhere, regardless of where they originate’’ [48]. 
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II-1. BRIEF DESCRIPTION AND FEATURES OF THE RBMK-1000 REACTOR 
OF CHERNOBYL UNIT 4 


Operating experience with pressure tube type reactors in the USSR amounts 
to over 580 reactor-years. This type of reactor was used in the world's first nuclear 
power plant in Obninsk, in Units 1 and 2 of the Beloyarsky nuclear power plant, in 
the Bilibino and Siberian nuclear power plants, and finally in a large group of plants 
with RBMK-1000 and RBMK-1500 reactors. Such is the history of these pressure 
tube type uranium-graphite reactors. 


Chernobyl Unit 4 was a heterogeneous pressure tube type thermal neutron 
reactor with a graphite moderator and a boiling light water coolant. There were 
1660 fuel channels in the vertical ducts of the graphite columns; these channels were 
tubes 80 mm in diameter made of zirconium alloy. Each fuel channel contained a 
fuel assembly incorporating 18 rod type fuel elements which were 13.6 mm in 
diameter and were enclosed in zirconium alloy cladding. 


The heat flow diagram is typical for single circuit boiling water reactors 
(Fig. II-1). The multipass forced circulation loop consists of two parallel loops each 
of which cools half of the fuel channels in the reactor. The coolant is circulated by 
the main circulating pumps (MCPs). Individual pipes supply subcooled water to each 
channel and remove the steam-water mixture. The steam and water are separated in 
the horizontal steam separator drums at a pressure of about 7 MPa. The saturated 
steam is sent to two turbines and the steam condensate is returned to the separators, 
after preheating and deaeration; it is then mixed with the separated saturated water 
and sent to the reactor inlet by the MCPs. 


The reactor control and protection system (RCPS) consists of 211 movable 
solid absorber rods in special channels cooled by an independent water circuit. In 
normal operating modes, and in design basis accidents (DBAs), the RCPS automati- 
cally maintains the preset power level; initiates a swift power reduction using the 
automatic and manual control rods if there are signals indicating main equipment 
failures; terminates the chain reaction using the rods of the emergency protection 
system (EPS) if there are signals indicating dangerous divergences in unit parameters 
or equipment failures; compensates for reactivity changes during heatup and when 
the reactor is being brought up to power; and controls the core power density. 

The independent control rods are inserted into the core at a speed of 0.4 m/s 
when the EPS is triggered. 

The RCPS has a local automatic control (LAC) subsystem and a. ‘local emer- 
gency protection (LEP) subsystem. Both these systems respond to signals from 
in-core ionization chambers. The LAC system automatically stabilizes the main 
harmonics of the radial-azimuthal power density distribution, while the LEP system 
protects the reactor by ensuring that the preset fuel assembly power level at specific 
core locations is not exceeded. The axial fields are controlled by shortened absorber 
rods which are inserted into the core from below (24 rods). 


103 





FIG. П-1. Schematic diagram of an RBMK plant. Key: 1: graphite reactor core; 2: fuel 
channel; 3: in-core instrumentation tube; 4: feedwater pipe; 5: steam separator drum; 
6: downcomer; 7: intake header; 8: main circulating pump; 9: bypass; 10: high pressure 
header; 11: stop valve; 12: distribution group header; 13: steam header; 14: steam dump 
valve; 15: accident localization system; 6: ECCS water reserve tank; 17: pressure controller; 
18: turbogenerator; 19: condenser; 20: moisture separator/reheater; 21: condensate pump; 
22: preheater; 23: deaerator; 24: emergency electric feedwater pump; 25: electric feedwater 
pump; 26: mixing preheater; 27: condensate collecting tank; 28: moisture separator/reheater 
condensate pump; 29: level controller; 30: ECCS hydraulic accumulator; 31: ECCS pump; 
32: ECCS header; 33: ECCS fast acting valve; 34: leak limiter. 


The RBMK 1000 reactor also incorporates the following monitoring and 
control systems: 


— radial (over 100 channels) and axial (12 channels) power distribution monitor- 
ing systems employing self-powered detectors (SPDs); 

— startup monitoring systems (reactivity meters, removable startup chambers); 

— a coolant flow rate monitoring system for each channel employing ball type 
flow meters; 

— a fuel rod leak monitoring system, which detects the short lived activity of 
volatile fission products in the steam- water lines sequentially at the outlet of 
each channel in the optimum energy ranges (‘windows’), using a scintillation 
detector and a photomultiplier moved by a special dolly from one line to the 
next; 
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— а pressure tube integrity monitoring system, which monitors the humidity and 
temperature of the gas circulating through the channels. 


All the data are sent to the computer. The information is presented to the opera- 
tors in the form of signals indicating divergences, readouts (which may be called up 
as required) and data from the recording equipment. 

The RBMK 1000 units are intended for base load operation (at constant 
power). 

The main design characteristics of the RBMK reactor in Chernobyl Unit 4 are 
as shown in Table II-I. 


TABLE II-I. MAIN DESIGN CHARACTERISTICS OF THE RBMK REACTOR 
IN CHERNOBYL UNIT 4 


Thermal power (MW) 3200 
Fuel enrichment (96) 2.0 
Mass of uranium in fuel assembly (kg) 114.7 
Number/diameter of fuel rods in fuel assembly (mm) 18/13.6 
Fuel burnup (MW -d/kg) 20 
Axial power peaking factor 1.40 
Radial power peaking factor 1.48 
Maximum design power of fuel channel (kW) 3000 
Void coefficient of reactivity a, at the working point 

(95^! (&k/k) void) +2.0 x 10% 
Fast power coefficient of reactivity œ, at the working point (МҰ!) -0.5 x 10% 
Fuel temperature coefficient of reactivity ат (*C^) -1. x 10° 
Graphite temperature coefficient of reactivity ag (*C^') 6 x 10? 
Minimum efficiency of RCPS rods (96) 10.5 
Efficiency of manual control rods (96) 7.5 
Effect (on average) of replacing a spent fuel assembly by a new one (96) 0.02 


One important physical characteristic from the point of view of reactor control 
and safety is the operational reactivity margin (ORM), which is expressed in terms 
of a specific number of equivalent fully inserted RCPS rods, depending on the axial 
neutron field. 

According to the Operating Procedures for Units 3 and 4 of the Chernobyl 
Nuclear Power Plant [see Annex I, Ref. [40]] (1Eh-S-11, рр. 34, 46), the ORM at 
rated power and in steady state mode should be 26-30 rods. 
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Reactor operation with ап ORM of less than 26 rods is permitted if authorized 
by the Chief Engineer at the plant. 


If the ORM decreases to 15 rods, the reactor should be shut down immediately. 


Raising the power after a short term shutdown (when there have been no iodine 
poisoning effects and the pre-shutdown power level was less than 50% of rated 
power) is allowed if the ORM prior to shutdown was at least 30 rods. 


The reactivity margin during a power raise following a short term shutdown 
must be at least 15 rods. 


If the reactivity margin drops to 15 rods and it continues to decrease when the 
RCPS rods are withdrawn while the reactor is reaching criticality, then all the auto- 
matic control, manual control and emergency protection overcompensation system 
rods must be inserted up to the bottom limit switches and the shortened absorber rods 
must be inserted into the zone of their greatest efficacy. The duration of the outage 
is determined from the depoisoning curves. 


The dependence of the effective multiplication factor on the coolant density in 
an RBMK is largely determined by the various kinds of absorbers which have been 
placed in the core. During initial loading of the core (which includes approximately 
240 additional absorbers containing boron), coolant vaporization in a fuel channel 
produces a negative reactivity effect. The increase in steam quality which occurs 
during normal on-line refuelling at rated power with a 30 rod reactivity margin 
causes a positive reactivity rise. 


The Unit 4 RBMK reactor was equipped with safety systems. These included 
the following: 


— reactor control and protection system (RCPS); 
— emergency core cooling system (ECCS); 
— main coolant circuit overpressure protection system; 
— reactor space overpressure protection system; 
— the accident localization systems, which include: 
® system of leaktight compartments 
® isolation valve system 
* pool type pressure suppression system; 
— executive safety systems; 
— control safety systems; 
— radiation monitoring system. 


Thanks to the aforementioned reactor characteristics, and the safety systems 
(including the protection, localization and executive safety systems) (Fig. II-2 and 
Table П-П), reliable and effective operation of RBMKs in all authorized regimes and 
safety for the whole range of DBAs have been maintained, in accordance with the 
approved design documentation. 
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RBMK reactors have the following drawbacks: 


— insufficient automatic engineered protection of the reactor to prevent its being 
put into an unauthorized regime; 

— the void coefficient of reactivity a, varies, and there is a coolant vaporization 
effect owing to decreased coolant density in the core; 

— the emergency protection system response is too slow, and a positive reactivity 
insertion can occur when there is an unacceptable decrease in the reactivity 
margin. 


Chernobyl Unit 4 was brought into operation in December 1983. When the 
unit was shut down for medium term maintenance, which was scheduled for 
25 April 1986, the core contained 1650 fuel assemblies with an average burnup of 
10.3 MW -d/kg, one additional absorber, and one empty fuel channel. Most of the 
fuel assemblies (75%) were from the first core charge and had a burnup of 
10-15 MW -d/kg. 

Unit 4 was designed in accordance with the safety codes and standards which 
were in force in the USSR in the late 1960s and early 1970s. The engineering design 
for the plant was developed in 1974. The design for the second stage of the plant 
was approved in the normal way. The design documentation on plant safety was 
approved by the USSR State Committee for the Supervision of Nuclear Power 
Safety, the USSR State Supervisory Committee for Industrial Safety and Mining 
Inspection, and the USSR State Committee for Public Health Supervision in 1975. 


П-2. LATEST VIEWS ON HOW THE CHERNOBYL ACCIDENT OCCURRED 
AND DEVELOPED 


The analysis of the circumstances surrounding the Chernobyl accident started 
on 27-28 April 1986 when specialists gained access to documents giving the main 
parameters in Unit 4 prior to the accident and during its first stage (until the measure- 
ment and recording systems failed). At least two factors were striking: first of all, 
the high speed of the process; secondly, the fact that there were hardly any control 
rods in the core during the run-up to the accident. It was more or less evident that 
the process was uncontrollable and that the reactor runaway had been caused by a 
positive reactivity effect. 

The first version of the events, which was put together in situ, was based on 
the assumption that the accident had been caused by an uncontrollable reactor run- 
away triggered by oversteaming in the core fuel channels as a result of a breakdown 
in coolant circulation in the multipass forced circulation loop. This breakdown in 
coolant circulation was in turn caused by a mismatch between the feedwater and 
coolant flow rates. 

After more detailed analysis of all the recorded information it became clear 
that, for a correct understanding of causes of the accident, computerized simulation 
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TABLE П-П. MAIN EQUIPMENT FOR АМ RBMK UNIT (see Fig. П-2) 








Number . а Mass Number 
in Fig. П-2 Equipment/component Unit (t) per unit 
Reactor section 
1 Graphite stack Set 1850 1 
2 System $ metal structures Set 126 1 
3 System OR metal structures Set 280 1 
4 System E metal structures Set 450 1 
5 System KZh metal structures Set 79 1 
6 System L metal structures Set 592 1 
7 System D metal structures Set 236 1 
8 Steam separator drum Item 278 4 
9 TsVN-8 main circulating pump Item 67 8 
10 MCP motor Item 33 8 
11 Main isolation valve, 800 m nominal bore Нет 5.7 8 
12 Intake header Item 46.0 2 
13 High pressure header Item 46.0 2 
14 Distributing group header Item 1.3 44 
15 Lower water lines Set 400 1 
16 Steam-water lines Set 450 1 
17 Downcomers, 300 mm nominal bore Set 16 1 
17a Main coolant circuit 800 mm nominal 

bore piping Set 350 1 
18 Refuelling machine Set 450 1 
19 Bridge crane in central hall (Q = 50/10 tf) Item 121 1 
20 Bridge crane in MCP room (Q = 50/10 tf) Item 176 2 
21 VDN type suction ventilator at level +43.0 Item 3.5 30 
22 Exhaust ventilator at level +35.0 Item 3.5 50 
23 Controlled leakage tank Item 1.4 2 
24 Controlled leakage system heat exchanger Item 0.2 2 
25 Planned preventive maintenance tanks Item 25 4 
26 Metal structures and piping in accident 

localization zone Set 270 
27 Non-return valves in lower water lines area Set 2.5 11 
28 Accident localization system bypass. valve Item 2 8 
29 Accident localization system condensers Item 3.7 36 
30 Container wagon? Item 146 1 
31 Crane in gas activity reduction system area* Item 45 1 

(© = 30/3 tf) k 

Carbon steel piping Item 1170 1 

Stainless steel piping Item 760 1 
Machine hall | 
32 Turbogenerator, type К-500-65/3000 Item 3500 2 
33 Moisture separator/reheater, type 500 Item 15 8 
34 Low pressure preheater Item 37.5 4 
35 Condensate pumps Item 2.5 6 
36 Bridge crane in machine hall (Q — 125 tf) Item 211 1 
37 Deaerator Item 4.5 2 

Carbon steel piping Set 3825 1 

Stainless steel piping Set 1300 1 


а [Not shown in the cross-section in Fig. П-2.] 


of the accident sequence would be required. This work was undertaken inependently 
by three organizations (the I.V. Kurchatov Institute of Atomic Energy (IAE), the 
Scientific Research and Design Institute for Power Technology (NIKIET), and the 
All-Union Scientific Research Institute for Nuclear Power Plant Operation 
(VNIIAES)). In addition, much experimental work was carried out at test facilities 
and in operating reactors. 

The significance of the void reactivity effect was assessed more closely, and 
the way in which the additional absorbers and control rods affect it. It was found 
that, for a double peaked axial neutron flux distribution, inserting the control rods 
from the top position could induce a negative reactivity insertion during the first 
second and then a reactivity rise as rod insertion continued owing to displacement 
of the water columns in the lower part of the reactor by the graphite displacers. 

In August 1986, an analysis of the accident was performed using an integrated 
model. This analysis formed the basis of the USSR’s report to the IAEA. This docu- 
ment states that the prime cause of the accident was ‘‘an extremely improbable com- 
bination of violations of instructions and operating rules committed by the staff of 
the unit’’, and that ‘‘the accident assumed catastrophic proportions because the reac- 
tor was taken by the staff into a non-regulation state in which the positive void coeffi- 
cient of reactivity was able substantially to enhance the power excursion’’ [see 
Annex I, Ref. [1], Part I, p. 23]. 

The subsequent analysis of the accident employed distributed neutron physics 
models with thermal hydraulics feedback. These models were validated against avail- 
able experimental data. 


The results which were submitted to the IAEA in September 1987 showed that 
axial-azimuthal effects had played a significant role. At the same time, the research 
using integrated models continued; with these, it was easier to assess the effects of 
the various physical processes and individual factors on the accident sequence. 


In October and November 1989, various aspects of the Chernobyl accident and 
the effectiveness of the measures to improve the safety of plants with RBMK reactors 
were discussed in detail at the first meeting of the international working group on 
severe accidents and their consequences held in Dagomys (USSR). At this meeting, 
specialists from the USSR and other countries presented papers in which they 
analysed the accident sequence using three dimensional neutron physics models, 
which took into account feedback on thermal-hydraulics. It was generally agreed that 
the accident was attributable to ‘‘reactor instability caused both by design faults and 
the operating regime.’’ The measures that had been implemented to improve reactor 
safety were deemed effective. 


Foreign participants noted that the actual details of the accident sequence might 
be different from those produced by the Soviet specialists, and it was recommended 
that the research continue. So far, three full scale models of the combined physical 
and thermal-hydraulic processes in an RBMK reactor have been developed, the 
details of which are given below. 
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II-2.1. Overview of the test programme that led to the accident 


The accident occurred during rundown tests on turbogenerator No. 8 in Unit 4 

with the auxiliary power system on load. 

The aim of the tests was to verify whether cooldown of the core by forced cir- 
culation could be maintained in the event of a total power loss. 

In the event of a total power loss during a DBA, the feedwater pumps, which 
form part of the third subsystem of the ECCS, are supposed to be powered from the 
rundown current of the turbogenerator. 

In 1982, some similar tests were performed in Unit 3 of the Chernobyl plant 
which showed that the excitation control system of the turbogenerator would require 
retrofitting if an acceptable current level was to be maintained for the required period 
of time during rundown of the turbogenerator. Additional rundown tests with the 
retrofitted excitation system were carried out in 1984 and 1985. In the 1982 and 1984 
test programmes, one MCP from each side of the reactor was connected up to the 
turbogenerator in rundown mode, whereas in the 1985 and 1986 programmes two 
MCPs were connected up from each side. In the 1984, 1985 and 1986 test pro- 
grammes, the ECCS was isolated using the manually operated valves. In the light 
of present day approaches to the drawing up of such test programmes, this 
programme is unsatisfactory primarily as regards the safety measures employed. 

It is incorrect to qualify these tests as purely electrical since they involve 
changes in the power supply circuit for main equipment in the unit and interventions 
on the normal protection and interlock systems. 

According to the Operating Procedures for Units 3 and 4 of the Chernobyl 
Nuclear Power Plant [see Annex I, Ref. [40]] (1Eh-S-11, p. 11), the plant manage- 
ment is responsible for preparing any programmes, drawings and technical 
documentation relating to assemblies, sensors, absorbers and other devices intended 
for use in the reactor while it is-operating at power that are not covered by the reactor 
design; it is also supposed to clear them with the Scientific Manager, the Chief 
Design Engineer and the Chief Designer, and have them approved by the USSR 
All-Union Production Group Soyuzatomehnergo. Any modifications to design 
components and systems in the reactor must be cleared with the Scientific Manager, 
the Chief Design Engineer and the Chief Designer, and approved by Soyuzato- 
mehnergo. Any changes which have nuclear safety implications must also be cleared 
with the USSR State Committee for.the Supervision of Nuclear Power Safety. 

One specific thermal-hydraulics feature of the test regime was the increased 
initial coolant flow rate through the reactor over the rated level. The steam quality 
was at minimum level and the coolant temperature at the core inlet was slightly below 
boiling point. Both the above factors turned out to have a direct bearing on the scale 
of the effects which occurred during the tests. 


II-2.2. Chronology of events at the Chernobyl plant on 25-26 April 1986 


[Table II-III presents the chronology of events at the Chernobyl plant on 25-26 
April 1986.] 
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TABLE П-Ш. CHRONOLOGY OF EVENTS АТ THE CHERNOBYL PLANT 
ON 25-26 APRIL 1986 


Time Event 


25 April 1986 
(time in operating 108) 


01:06 Start of unit power reduction; operational reactivity margin 
(ORM) equals 31 manual control rods 


03:45 Replacement of nitrogen-helium mixture used to cool the 
graphite stack with nitrogen commences 


03:47 Thermal reactor power 1600 MW 
07:10 ORM equals 13.2 manual control rods 
13:05 Turbogenerator 7 disconnected from the grid 


14:00 ECCS isolated from the circulation circuit; test programme 
postponed by request of the grid controller Kievehnergo 


15:20 ORM equals 16.8 manual control rods 


18:50 Auxiliary power equipment not required for tests switched over 
to operating transformer T-6 


23:10 Unit power reduction continues; ORM equals 26 manual con- 
trol rods 


26 April 1986 


00:05 Thermal reactor power 720 MW; steady unit power reduction 
continues 


00:28 With thermal reactor power at around 500 MW, switchover 
from local power control system (LAC) to main range auto- 
matic power controllers 1 and 2; an unplanned drop in thermal 
power to 30 MW was permitted during this switchover 
(neutron power dropped to zero); after a pause lasting 4 to 
5 min, a power raise was initiated; 


(time on printout of DREG) 


00:34:03 Level in steam separator drums went beyond the triggering 
00:43:37 set point for the emergency protection system of —600 mm 
00:52:27 (emergency set point for a level drop was left at — 1100 mm) 
01:00:04 

01:09:45 

01:18:52 


TABLE II-III. (cont.) 


Time 


26 April 1986 (cont.) 


00:41-01:16 
(in operating log) 


00:43:37 


01:03 
(in operating log) 


01:03 
(in operating log) 


01:06 
01:07 


(in operating log) 
01:09 


01:18:52 
01:22:30 


01:23:04 


Event 


Turbogenerator 8 disconnected from grid to check 
vibrational characteristics on no load running 


The emergency protection system which shuts down both tur- 
bogenerators was disabled 


Thermal reactor power raised to 200 MW and stabilized at this 
level 


МСР-7 switched оп 


Feedwater flow rate raised to 1200-1400 t/h to restore level in 
steam separator drums 


MCP-8 switched on 


Sudden reduction in the feedwater flow rate to 90 t/h on the 
right hand side and 180 t/h on the left hand side for a total 
flow rate in the circuit of 56 000-58 000 t/h; as a result, the 
temperature at the MCP inlet reached 280.8°C (left side) and 
283.2°C (right side) 


DBA signal (according to the DREG program) 


Parameters of the SKALA centralized monitoring system 
recorded on magnetic tape; non-measurable parameters at the 
Chernobyl plant were not calculated; after the accident, the 
ORM was calculated using the standard axial power distribu- 
tion curve in the PRIZMA program, which yielded a value of 
1.9 manual control rods; the calculations using real data on the 
axial power distribution yielded an ORM value of 6-8 manual 
control rods : | 


‘Oscillograph on’ command given, stop valves for turbine 

No. 8 closed, turbine rundown operation commences; accord- 
ing to the oscillograph that was recording the electrical 
parameters of the MCPs, the MCPs that were connected to the 
turbogenerator in rundown mode operated for 36.2 s; the DBA 
button was pressed’; the exact times at which the DBA button 
was pressed and at which the oscillograph was turned on are 
not known 


TABLE II-III. (cont.) 


Time 


26 April 1986 (cont.) 


01:23:40 


01:23:43 


01:23:47 


01:23:48 


01:23:49 


01:24 
(in operating log) 


Event 


EPS-5 (emergency protection system 5) signal recorded; 
according to the explanatory notes written by personnel, the 
ЕР$-5 button was pressed; insertion of emergency protection 
and manual control rods into the core commenced 


All the lateral ionization chambers generated emergency 
protection signals for a reactor runaway and overpower 


Sudden drop in flow rate (by 40%) in MCPs not involved in 
the rundown operation, and misleading readings for the flow 
rates in the MCPs which were involved in the rundown opera- 
tion; sudden rise in the pressure and level in steam separator 
drums; signals for a measurement fault in both the main range 
automatic controllers 


Flow rates in MCPs not in the rundown operation restored 
almost to initial levels; continued rise in the level and pressure 
in the steam separator drums (left side 75.2 kg/cm?; right side 
88.2 kg/cm?); triggering of fast acting steam dump to 
condenser systems for turbine 


Emergency protection signal for a pressure rise (fuel channel 
rupture) in the reactor space; ‘No voltage equals 48 V’ signal 
(RCPS rod drive couplings de-energized); signals indicating a 
fault in the actuators for main range automatic controllers 1 
and 2 


Severe shocks recorded; RCPS rods stopped before reaching 
limit switches; power supply to RCPS rod drive coupling 
switched off 


* A DBA button had been specially installed for the test programme to simulate the DBA 
signal. The signal was to be transmitted to the startup circuit of the diesel generator and 
to the turbogenerator rundown system to start that. The button was to be pressed when the 


stop valves closed. 


П-2.3. Data on information sources 


The processes prior to and during the accident were analysed using data from 
the following instruments and computer systems. 
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1l-2.3.1. Standard recording equipment 


. This equipment is used to record relatively slow processes (maximum tape 
speed 240 mm/h). It can record extreme parameter values rather accurately but is 
not suitable for reconstructing fast transients. 


П-2.3.2. SKALA centralized monitoring system and subsystems 


This system calculates the main reactor parameters approximately every 5 min 
(this limitation is due to the capacity of the V-3M type computer). Of course, this 
cycle is too long for the analysis of fast processes. 

The diagnostic parameter recording program (DREG) scans and records 
several hundred discrete and analogue signals. However, it does not record the main 
reactor parameters such as the power and reactivity levels, the coolant flow rate in 
the channels and other mass parameters. The positions of only nine of the 211 RCPS 
rods are recorded, including one rod in each of the three groups of automatic 
controllers. These parameters are not directly measurable and their scan cycle is 
therefore much longer (1 min). Although the recording cycle for some parameters 
is short (1 s), the length of the scanning interval may be rather uncertain as the 
DREG program has a very low priority in the SKALA system. Moreover, during 
the hour preceding the accident there were three interruptions in the running of the 
DREG program caused by a SKALA system restart. This resulted in additional 
losses of information. The cycle for other results produced by the SKALA system 
is longer (5 min), including the PRIZMA program and the recording of reactor status 
data on magnetic tape (RESTART); and there are interruptions caused by system 
restarts and certain software features. In addition, the results produced by the 
PRIZMA program are recorded only on printouts. The process parameter data 
produced. by the DREG program are given. 


П-2.3.3. Oscillography 


A non-standard system employing.oscillographs to record rapidly varying 
parameters was installed for the test programme. It monitored the operating 
parameters of certain items of electrical equipment. However, these electrical equip- 
ment parameters were not synchronized with the reactor parameters recorded by the 
system. 


П-2.3.4. Other information obtained from operational sources 
This category includes entries in the operating logs and the tape recordings of 
telephone calls made by personnel. This information and the explanatory notes 


written by personnel did not turn up any further essential data above and beyond that 
recorded by the instrumentation. In some cases, the accounts of the sequence of 
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events given by personnel were highly inaccurate. Most importantly, the majority 
of people reported that there had been two explosions. The operating logs also 
contain entries which confirm the chronology just given of events before and after 
the accident. 


II-2.4. Initial explanations of the accident 


Once the nature of the damage and some details of the accident became known, 
a number of explanations and scenarios were put forward in an attempt to understand 
and explain what had happened. Some of these were rather fanciful and others were 
quite convincing. Most of them were rejected when additional information on the 
damaged unit became available, or pursuant to more detailed analysis. 

The analysis centred around attempts to identify contradictions between the 
expected effect of a particular explanation of the accident and the available factual 
data recorded by the DREG program. 


II-2.5. Computerized simulation of the accident 
П-2.5.1. Опе dimensional simulation 


A one dimensional program was used to simulate the power reduction transient 
which took account of iodine-xenon kinetics and feedback on the temperatures of 
graphite and fuel and on the coolant density. 

Figure II-3 shows the power reduction curve (the power reduction started at 
01:06 on 25 April). Figure II-4 shows the time dependence of the ORM and indicates 
the actual ORM values where these are known. 

It is clear that the ORM dropped initially below the minimum permissible level 
of 15 manual control rods owing to the 50% power reduction. By 22:00 on 25 April, 
it had been restored almost to its initial value. A further power reduction seon 
followed, and the ORM started to fall reaching a value of no more than 6-8 manual 
control rods prior to the accident. Figure II-4 also shows the axial peaking factor К, 
as a function of time. The shape of the axial field is shown in Fig. II-5. Prior to the 
accident, the field had a double peaked shape with a large upper maximum. 


П-2.5.2. Characteristics of the three dimensional models 
Model 1 (developed by the I. V. Kurchatov Institute of Atomic Energy) 

The neutron field is described by a system of two-group equations with a point 
for each cell in the finite difference grid. The WIMS code is used to calculate the 
neutron cross-sections. The initial status can be adjusted to match the readings from 


the in-core detectors. The thermal hydraulics module describes the section of the 
circulation circuit from the high pressure header to the steam separator drums. The 
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FIG. 11-3. The Chernobyl accident: change in power level with time (from initiation of the 
power reduction). 
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FIG. П-4. The Chernobyl accident: change in the operating reactivity margin p, and the 
power peaking factor (non-uniformity factor of the axial field) K, during the transient. 
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FIG. П-5. The Chernobyl accident: axial distribution of the thermal neutron flux density in 
the core at various times during the xenon transient preceding the accident: 1: 00:00; 
2: 07:00; 3: 22:00; 4: 24:30 (before the accident). 


model has been tested against a large number of steady state modes and transients 
in operating reactors. 


Model 2 (developed by the Scientific Research and Design Institute for 
Power Technology (NIKIET)) 


The neutron field is described by a one-group equation. The number of differ- 
ence grid nodes in the reactor plan varied from 140 to 2000. The constants were 
derived from the two-group constants that were obtained using the WIMS code. The 
thermal hydraulics module describes the section of the circuit from the distributing 
group header to the steam separator drums. A single fluid homogeneous model is 
used for one dimensional flow of the two phase coolant with empirical corrections 
for phase slipping. 


Model 3 (developed by VNIIAES in collaboration with the Nuclear Research 
Institute of the Academy of Sciences of the Ukrainian SSR, Kiev) 


The neutron field is described by a one-group equation with one point for every 
four cells. The constants were derived from data that were obtained using the WIMS 
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code. The thermal hydraulics diagram of the reactor circuit is described in detail, 
including the two coolant circulation loops. The equations from the single tempera- 
ture variant of the flow model with slipping are used. The slipping functions and the 
flow regime map are taken from the TRAC-PIA code. 

Thus, these three models differ significantly from one another. On the other 
hand, the fact that we have three independent models and the opportunity to compare 
results enhances the validity of the main conclusions drawn pursuant to the analysis 
of the accident sequence. 


H-2.5.3. Calculation results 


First of all, the positions of all the controllers (Fig. П-6) and the power density 
field for 01:22:30 on 26 April 1986 were reconstructed. The radial-azimuthal distri- 
bution is shown in Fig. II-7, and the readings frdm the axial distribution sensors in 
Fig. II-8. At the point in time corresponding to 01:23:40 on 26 April 1986, the inser- 
tion of all the RCPS rods into the core pursuant to the EPS-5 signal was simulated. 

All three models indicate a drop in reactivity during the first one second. Then, 
the neutron field is redistributed, the maximum shifts to the bottom of the core 
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FIG. П-6. The Chernobyl accident: plan of the core showing the insertion depths of the RCPS 
rods in centimetres. 
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FIG. 11-7. The Chernobyl accident: radial distribution of the initial neutron field in the core. 
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FIG. 11-8. The Chernobyl accident: distribution of the power density profile over the core 
volume as recorded by the axial detectors. 
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(Fig. П-9), and the reactivity and the integrated power level start to increase. Under 
abnormal conditions, this effect is caused by control rod design features: when the 
rod is inserted into the core from the top position (Fig. II-10), the multiplication 
factor in the bottom of the core increases owing to replacement of the neutron 
absorbing water column by the graphite displacer. The changes in the reactivity and 
the integrated power level which were generated by Model 1 are shown in Fig. II-11. 

Owing to the low departure from nuclear boiling (DNB) ratio of the coolant 
at the reactor inlet immediately prior to the accident, the effect which the positive 
void coefficient of reactivity had on the power rise was significantly enhanced. 

The various models yield strikingly different values for the absolute level of 
the integrated power surge, ranging from 3.5 times the initial value in Model 2 to 
approximately 80 times the initial value in Model 1; Model 3 yields an intermediate 
value of around 9 times the initial value, All three models display a high level of 
non-uniformity of the volumetric field (approximately 6.0), even though the 
deformation of the radial field differs significantly from model to model; this is 
typical for large scale reactors. 

However, one fact cannot be avoided: none of the three models reproduces the 
reactor runaway when, three seconds after EPS-S is triggered, signals are generated 
indicating that the emergency set points for the power level and the rate of power 
rise have been exceeded. 
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FIG. 11-9. The Chernobyl accident: distortion of the axial neutron fields during rod insertion 
at the time when the accident occurred. The displacement of the neutron flux maximum to the 
lower part of the core is clearly shown. Key: time after EPS-5 button was pressed: *: 0 s; 
0:45; O: 6s; A: 7s. 


The models need to be further refined both with regard to their neutron physics 
and their thermal-hydraulic elements to achieve a better fit between the calculation 
results and the experimental data. 

One highly important point which was noted by all the groups of research 
workers is the very strong dependence of the characteristics of the transient on the 
potential error level of the initial axial distribution, the void reactivity effect value, 
the change in the reactivity level when the water column in the RCPS channel is 
replaced by the graphite displacer, and many other factors. 

By eliminating the major deficiencies which cause reactor instability we can 
preclude the possibility of an accident of this kind recurring. Indeed, calculations 
using the same models and for the initial reactor states already analysed, but with 
present day parameters, show that the reactor is shut down sufficiently quickly. 
Thus, all the models can be said to yield equivalent results. 

Nevertheless, the results obtained from the analysis of the first phase of the 
accident cannot be viewed as final: the models could probably be made to agree more 
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FIG. П-10. The RBMK reactor: schematic representation of the reactivity insertion caused 
(b) manual control rod partially inserted; (c) the change in the theoretical reactivity insertion 


by inserting the RCPS rods from the top position. (a) Manual control rod withdrawn 
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The main factors that affected the accident sequence were the positive void 
reactivity effect and RCPS design deficiencies which caused the insertion of positive 
reactivity under the reactor conditions prevailing prior to the accident. These conclu- 


derlie the measures which were elaborated to improve the safety of plants 


with RBMK reactors. 
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FIG. 11-11. The Chernobyl accident: time dependence of the reactivity level and the neutron 
power during the initial phase of the accident. D: reactivity; А: neutron power. (Reactivity 
is expressed in units of effective delayed neutron fraction В.п.] 


П-3. MEASURES TO IMPROVE THE SAFETY OF PLANTS WITH 
RBMK REACTORS 


Pursuant to the analysis of the causes of the accident in Chernobyl Unit 4, 
organizational and technical measures were developed to improve the safety of oper- 
ating plants with RBMK reactors. 


First of all, measures were developed and put into effect which aimed at: 


— reducing the positive void coefficient of reactivity; 
— improving the response efficiency of the emergency protection system; 


— introducing ORM calculation programs which output a numerical indication of 
the current ORM value on the operator's control panel; 


— preventing the emergency protection systems from being shut down while the 
reactor is operating at power; 


— avoiding regimes which cause a reduction in the DNB ratio of the coolant at 
the reactor inlet. 
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The reduction in the void coefficient of reactivity was implemented in two 
steps. First of all, its value was reduced to +В by installing additional absorbers in 
the core (80-90) and increasing the ORM to 43-48 RCPS manual control rods. 
Table II-IV gives the measured values for the void and fast power coefficients in all 
units with RBMK reactors currently in operation. Figure II-12 shows the dependence 
of the reactivity level on the coolant density both before and after the safety measures 
were implemented, and the design basis dependence. The second step in reducing 
the void coefficient of reactivity involves converting all the reactors to use fuel with 
а 2.4% 2350 enrichment level. 

Three independent retrofitting operations were carried out to improve the effi- 
ciency and response speed of the emergency protection system. 

First of all, the manual control rods were replaced with ones of improved 
design which do not give rise to water columns at the bottom end of the RCPS 
channels and have a larger absorber section (Fig. П-13). 

The RCPS rod drives were retrofitted, reducing the time required to insert the 
rods fully into the core from 18 to 12 s. The implementation of these first two mea- 
sures has improved by several times the response efficiency of the emergency protec- 
tion system during the first few seconds of rod insertion. 

As a third measure to improve the performance of the emergency protection 
system, a fast acting emergency protection system was developed and systems of this 
kind were installed in all operating reactors. The actuator in this system cools the 
channel wall with a thin film of water and moves the rod in a gas medium. In 
1987-1988, this new system was put through full scale testing at the Ignalina and 
Leningrad plants. The tests confirmed the design characteristics of the system, i.e. 
24 fast acting EPS rods in less than 2.5 s cause an insertion of negative reactivity 
of over 28 [where В is the delayed neutron fraction] (Fig. 1-14). All RBMK reactors 
are now equipped with these systems. 

Figure II-15 shows the improved level of response efficiency which has been 
achieved by retrofitting the RCPS rods and installing the fast acting emergency pro- 
tection system by comparison with the response efficiency of the system at the time 
of the accident in Unit 4 in terms of reactivity change curves. 

By implementing the above measures to improve the neutron physics charac- 
teristics of the reactor and significantly improving the performance of the emergency 
protection system, we have been able to preclude the possibility of an uncontrolled 
power rise during a loss of coolant accident (LOCA) and limit the consequences of 
all DBAs to the permissible levels for radiation exposure of personnel, the general 
public and the environment. 

The operational documentation was updated to take account of the results of 
the accident analysis and the measures which have been implemented to improve the 
safety of plants with RBMKs. 

Of course, there are six first generation RBMK units which have no reinforced 
leaktight compartments and no special structures to localize radioactive releases. The 
main aim in these units must be to reduce the probability of large diameter pipe 
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FIG. П-12. The RBMK reactor: dependence of the reactivity level p on the coolant density тү. 
1: design calculations; 2: actual dependence at the time when the accident occurred on 
26 April 1986; 3: current status after improvements. 


breaks up to a point where such incidents might be termed hypothetical. With this 
in mind, some computerized and experimental research was carried out into the 
processes which cause cracks to appear and propagate in metal, and critical crack 
sizes were determined for cracks which might cause a pipe break. Pursuant to this 
research, a set of procedures were elaborated for enhanced monitoring of the metal 
in large diameter piping. These set out requirements for monitoring equipment, the 
periodicity of monitoring, the training and qualifications required by flaw detector 
operators, etc. 

Over the period 1986-1990, the welded joints in the 800 mm nominal bore 
piping and 900 mm nominal bore headers in the circulation circuit were subjected 
to ultrasonic testing in all units. VNITAES, in the light of the results of this recent 
testing, estimates the probability of a break in piping of this kind at 0.75 x 10° 
per reactor-year. 100% monitoring of the state of the metal and hydrostatic tests are 
carried out once every four years. Work is under way to develop automated non- 
destructive testing (NDT) systems which would help eliminate the manual work done 
by the flaw detector operators and thus reduce the probability that faults might be 
overlooked. We plan to install prototype automated NDT systems in 1991. 
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НС. 11-13. Manual control rods in the RBMK reactor. (а) old design rod; (b) old design rod 
inserted into the core to avoid the insertion of positive reactivity; (с) retrofitted rod. 1: rod 
withdrawn; 2: rod inserted. [Dimensions are given in centimetres.] 


One of the problems of pressure tube type reactors which was widely discussed 
after the Chernobyl accident is the possibility of a simultaneous rupture of a large 
number of fuel channels. The existing steam dump system for the reactor space is 
designed to cope with the steam discharge from a simultaneous rupture of two 
channels, the probability of such an event being low.” 

Over the period in which these units have been operating, several incidents 
involving fuel channel damage have occurred. In two of these incidents (which were 
caused by local power tilting and an interruption in coolant flow triggered by 
procedural breaches), the fuel channels and the fuel assemblies in them were almost 
totally destroyed. However, in both cases there was no damage to the adjacent fuel 
channel pressure tubes which are all still operating normally. Nevertheless, despite 
the relatively low probability of an event of this kind, an emergency steam dump 
system for the reactor space has been installed in the recently commissioned Unit 3 
at the Smolensk plant which is designed to cope with the steam discharge from a 
simultaneous rupture of 9-10 fuel channels. Similar measures will be implemented 
at all operating units in the course of the planned retrofitting programmes for these 
reactors. 

Retrofitting projects are currently being elaborated for first generation units 
with RBMK reactors in order to bring them into line as far as possible with recently 


2 NIKIET estimates it at 10^? per reactor-year. 
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FIG. Il-14. The RBMK reactor: reactivity level p and neutron power М: testing of the fast 
acting emergency protection systerh at the Leningrad and Ignalina nuclear power plants. 
N, = 0.4 Naom 1: theoretical calculations; 2: experiment at the Leningrad plant; 3: experi- 
ment at the Ignalina plant. 


introduced, more stringent requirements. These projects are based on a retrofitting 
design which has gone through many stages of díscussion and authorization. 
The retrofitting design provides for the following: 


— development of more efficient emergency core cooling systems; 

— total replacement of the reactor control and protection systems and develop- 
ment of a multizone power density monitoring and emergency protection 
system which works on signals from in-core detectors; 
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FIG. H-15. The RBMK reactor: efficiency of the emergency protection system. I: the 
Chernobyl! plant on 26 April 1986, ORM = 7 manual control rods (DBA conditions); 2: ORM 
as specified in the Operating Procedures (15 manual control rods); 3: retrofitted RCPS, 
ORM = 30 manual control rods; 4: retrofitted RCPS, fast acting emergency protection system 
in operation. 


— multitrain redundancy of safety systems; 

— full-scale introduction of automated metal monitoring systems; 

— improvement of the efficiency and reliability of the auxiliary power systems; 

— improvement of the resistance of reactor structures and components to 
earthquakes; 

— improvement of the capacity of the steam dump system for the reactor space, 
and other measures. 


During the retrofitting outages we also plan to replace all the fuel channels in 
all reactors. On the whole, units with RBMK reactors have a good performance 
record (Table II-V). 

As of the beginning of 1991, the installed capacity of plants with RBMK reac- 
tors accounted for 16.5 GW, or some 45% of the total installed capacity of nuclear 
power plants in the USSR (36.6 GW). In 1990, RBMK plants generated 47.8% 
(101.0 x 10? kW-h) of the total quantity of nuclear electricity generated in the 
country (211.5 x 10? kW-h). 


131 


1-4. CONCLUSIONS 


Since the Chernoby] accident, a great dea] of analytical work has been done. 


The aims of this work were as follows: a more accurate determination of the status 
of Unit 4 prior to the accident; the processing of factual data from the monitoring 
system on the accident sequence; the analysis of the status of the unit after the acci- 
dent; and mathematical modelling of the first phase of the accident. 


On the basis of this research, and the discussions which have been held at 


various meetings (including international meetings) on the results obtained, the 
following main conclusions may be drawn: 


(1) 


(2) 


(3) 
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The accident was caused by interaction of the following main factors: the 
physical characteristics of the reactor; specific design features of the control 
elements; and the unauthorized state into which the reactor was brought. 
Thanks to the availability of new, up to date computer programs, the use of 
powerful computers, and experimental studies which have been carried out on 
the coolant vaporization effect in RBMKs, we have been able to define more 
accurately the main physical parameters of the reactor and thus develop new 
sets of requirements for systems which improve reactor safety. 

The safety level of RBMK reactors has been significantly enhanced by a series 
of organizational and technical measures which have been implemented as part 
of the ‘Comprehensive Action Plan’. These measures include: modification of 
the physical characteristics of the reactor by installing additional absorbers; 
conversion to fuel with a 2.4% enrichment level; installation of a fast acting 
emergency protection system; updating of operational documentation and 
improvement of staff qualifications; tightening up of the operating procedure 
requirements. 


LIST OF ACRONYMS AND SYMBOLS 


AA Additional absorber 

DBA Design basis accident 

DNB Departure from nuclear boiling 

DREG Diagnostic parameter recording program 

ECCS Emergency core cooling system 

EPS Emergency protection system 

FAEP Fast acting emergency protection 

GKNT State Committee for.Science and Technology of the USSR Council 
of Ministers 

GPAN Scientific and Technical Centre of the SCSSINP 
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